User’s Guide 


Publication number E3454-97006 
February 2002 


© Copyright Agilent Technologies, Inc. 1994-2002 
All Rights Reserved 


For Safety information, Warranties, and Regulatory information, 
see the pages behind the index. 


pee Agilent Technologies 


Emulation for the 
PowerPC 400/600/700 


Agilent Technologies E5900B Option 060/070 
Emulation Probe—At a Glance 


This manual describes how to set up: 


e anemulation probe 
¢ an emulation module 
e an emulation migration 


The emulation probe provides a low-cost way to debug embedded software for 
PowerPC 400/600/700 family microprocessors. The emulation probe lets you 
use the target processor’s built-in debugging features, including: run control, 
register access, and memory access. A high-level source debugger can use the 
emulation probe to debug code running on the target system. 


The emulation probe can be controlled by a debugger on a host computer or 
by the Emulation Control Interface on an Agilent 16700-series logic analysis 
system. The emulation probe communicates with a host computer or logic 
analysis system via LAN. 
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E5901B Emulation Module Kit 


The Agilent E5901B emulation module kit includes the E5900B emulation 
probe, the E5901B emulation module, and other items listed on page 22. The 
Agilent E5901B emulation module plugs into your Agilent 16700-series logic 
analysis system frame. It provides power, cross triggering, and limited 
communication for the E5900B emulation probe through the module/probe 
interconnect cable. The logic analysis system communicates with the target 
system through the LAN connection to the E5900B emulation probe. 
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E5902B Emulation Migration Kit 


The emulation migration includes the parts needed to use an emulation probe 
for a new processor family. 


Emulation Solution 


If you have an E9xxxB emulation solution, refer to the appropriate Logic 
Analysis Support User’s Guide (or Solutions User’s Guide) for information 
on how to connect the analysis probe, then return to this book for information 
on connecting the emulation probe. 
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In This Book 


Emulation Probe 


Processor supported 


Product ordered 


Includes 


PPC401 (all), PPC403 (all), 
PPC405 (all), NPe405H, 
NPe405L, PPC440A4, 
PPC440GP. 


PPC603e rev. 1, 3, 4, 5; 


MPC603e; PPC603ev rev. 2, 


12; PPC603e2; MPC603P; 
MPC603ec; MPE603R; 
MPC603ei. 


PPC740/50, MPC740/50, 
PPC750M, MPC740P/50P, 
MPC745/55, PPC750CX, 
PPC750CXe. 


E5900B Option #060 


E5900B Option #060 


E5900B Option #070 


E5900B #060 emulation probe, cables, 
software, and manual. 


E5900B #060 emulation probe, cables, 
software, and manual. 


E5900B #070 emulation probe, cables, 
software, and manual. 


Emulation Module Kit 


Processor supported 


Product ordered 


Includes 


PPC400-series 
(Versions listed above.) 
PPC600-series 
(Versions listed above.) 
PPC700-series 
(Versions listed above.) 


E5901B Option #060 
E5901B Option #060 


£5901B Option #070 


E5901B emulation module, E5900B #060 
emulation probe, cables, software, and 
manual. 


Emulation Migration Kit 


Processor supported 


Product ordered 


Includes 


PPC400-series 
(Versions listed above.) 
PPC600-series 
(Versions listed above.) 
PPC700-series 
(Versions listed above.) 


E5902B Option #060 
E5902B Option #060 


£5902B Option #070 


Target board adapter, front panel, tool kit, 
cables, software, and manual. 
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Emulation Solution 


Processor supported 


Product ordered 


Includes 


PPC603e rev. 1, 3, 4, 5; 
MPC603e; PPC603ev rev. 2, 
12; MPC603ei. 


E9487B Option #001 


E5901B emulation module, E5900B #060 or 
E5900B #070 emulation probe, cables, 
software, and manual, plus analysis 
software as described in the Logic Analysis 
Support User's Guide. 


PPC603e rev. 1, 3, 4, 5; 
MPC603e; PPC603ev rev. 2, 
12. 


E9487B Option #002 


Everything in the E9487B Option #001 and 
the 240-pin POFP analysis probe. 


PPC740/50, MPC740/50, 
PPC750M, MPC740P/50P, 
MPC745/55, PPC750CX, 
PPC750CXe. 


E9486B Option #001 


E5901B emulation module, E5900B #070 
emulation probe, cables, software, and 
manual, plus analysis software as 
described in the Logic Analysis Support 
User's Guide. 


The E5900B emulation probe has been programmed with firmware at the 


factory. 


The firmware is a driver that lets the emulation probe communicate with a 
certain family of processors. Consult the chart on page 136 to determine 
whether the factory-loaded firmware is compatible with your target processor. 
If not, you will need to update the firmware as described in Chapter 10, 
“Updating Firmware,” beginning on page 135. 


In this manual "PowerPC" is used to refer to both the IBM PPC family of 
PowerPC processors and the Motorola MPC family of PowerPC processors. 
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Overview 


Chapter 1: Overview 


This chapter describes: 


e Setup flowchart 

e Equipment used with the emulation probe 

e Equipment used with the emulation module 

e Equipment used with the emulation migration 
e Connection sequences for the emulation probe 
e Additional information sources 
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Setup Flowchart 


Setup Flowchart 
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Chapter 1: Overview 
Agilent E5900B Emulation Probe 


Agilent E5900B Emulation Probe 


Equipment supplied 

Part Number Description 

E3452B or E3454B Emulation probe (E5900B Option 060 or Option 070). 

0950-3043 12V power supply for the emulation probe. 

XXXX-XXXX Power cord. Part number depends on country of use. 
E8130-68703 Ferrite. Reduces electromagnetic interference on power cord. 
E8130-68702 Cable kit consisting of a serial cable and RJ12-to-DB9 adapter, 


for setting the emulation probe's IP address from a PC. 


E3494-61604 16-pin JTAG ribbon cable. 


Connects the emulation probe to the target debug port. 


E3454-97006 This User's Guide. 


Minimum equipment required 


The following equipment is required to use the emulation probe: 


A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG (Joint Test Action Group) 
debug port connector. The target system must meet the criteria described 
in Chapter 2, “Designing a Target System for an Emulation Probe,” 
beginning on page 25. 

A host computer, such as a PC or workstation. You can also connect the 
emulation probe to an Agilent 16700-series logic analysis system. 

ALAN (local area network) if you want to connect the emulation probe to 
a host computer. 

A user interface on the host computer, such as a high-level source 
debugger or the logic analysis system’s Emulation Control Interface. 
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Agilent E5900B Emulation Probe 
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Agilent E5901B Emulation Module Kit 


Agilent E5901B Emulation Module Kit 


Equipment supplied 


The Agilent E5901B emulation module facilitates communication between the 
Agilent 16700-series logic analysis system and the Agilent E5900B emulation 
probe. If you ordered an emulation module as part of your Agilent 16700- 
series logic analysis system, it is already installed in the frame. 


The equipment supplied with your emulation module includes: 


All of the parts listed for the Agilent E5900B emulation probe on 
page 16 (except the serial cable and RJ12-to-DB9 adapter), and: 


Part Number Description 

E5901B Agilent E5901B emulation module. 

5061-7342 LAN crossover cable (for point-to-point LAN connection only). 
B3760A Emulation probe firmware, and logic analyzer software ona 


CD-ROM. 


E8130-61601 


14-pin probe-to-emulation module interconnect cable. This is 
shipped attached to the emulation module. It connects the 
emulation module to the emulation probe. 


E5901-68701 


Module installation kit consisting of the emulation module-to- 
logic analyzer expansion cable and Torx T-10 and T-15 
screwdrivers. 

NOTE: This kit is included only when the module is ordered 
without a logic analysis system. If a module is ordered with a 
logic analysis system, the module will be installed at the factory 
and the installation kit will not be included. 


Minimum equipment required 


The following equipment is required to use the emulation module: 


A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG debug port connector as 
described in Chapter 2, “Designing a Target System for an Emulation 
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Agilent E5901B Emulation Module Kit 


Probe,” beginning on page 25. 


An Agilent 16700-series logic analysis system. 
A user interface, such as a high-level source debugger or the logic analysis 


system’s Emulation Control Interface. 
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Agilent E5902B Emulation Migration Kit 


Agilent E5902B Emulation Migration Kit 


Equipment supplied 
The equipment supplied with your emulation migration includes: 


Part Number Description 


E8130-66503 Target board adapter (formerly called cable board). 
This board customizes the emulation probe for a particular 
target type. It is called "6XX cable board" on the contents list. 


E8130-00201 Front panel for the emulation probe. 

E8130-68701 Tool kit: 1/4 inch wrench, Torx T-10 screwdriver, and a #1 
Phillips screwdriver. 

E3494-61604 16-pin JTAG ribbon cable. 
This connects the emulation probe to the target debug port. 

B3760A Emulation probe firmware, and logic analyzer software ona 
CD-ROM. 

E34xx-XXXXX Firmware for the emulation probe on a 3.5-inch disk, for use if 
you do not have an Agilent logic analysis system. 

E3454-97006 This User's Guide. 


Minimum equipment required 


The following equipment is required to use the emulation migration: 


e An Agilent E5900B emulation probe. 

e A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG debug port connector. The 
target system must meet the criteria described in Chapter 2, “Designing a 
Target System for an Emulation Probe,” beginning on page 25. 

e A host computer such as a PC, a workstation, or an Agilent 16700-series 
logic analysis system. 

e Auser interface, such as a high-level source debugger or the logic analysis 
system's Emulation Control Interface. 


20 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 1: Overview 
Agilent E5902B Emulation Migration Kit 
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To connect the emulation probe to a power source 


To connect the emulation probe to a power 
source 

The emulation probe is shipped from the factory with a power supply and cord 
appropriate for your country. If the cord you received is not appropriate for 


your electrical power outlet type, contact your Agilent Technologies sales and 
service office. 


WARNING: /\ Use only the supplied Agilent F1044B power supply and cord. Failure 
to use the proper power supply could result in electric shock. 


CAUTION: Use only the supplied Agilent power supply and cord. Failure to use the 
proper power supply could result in equipment damage. 


1 Install the ferrite on the 12V power cord, near the end which plugs into 
the emulation probe. 


2 Connect the power cord to the power supply and to a socket outlet. 


Ferrite 
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To connect the emulation probe to a power source 


Turn on the emulation probe power switch. 


Connection Sequence 


Disconnect power from the target system, emulation probe, and logic analyzer 
before you make or break connections. 


Connect the emulation probe to a LAN (page 37). 
Connect the emulation probe to your target system (page 59). 


Configure the emulation probe (page 69). 


To power on the system 

With all components connected, power on your system as follows: 
Logic analyzer, if you are using one. 

Emulation probe. 


Your target system. 


To power off the system 
Power off your system as follows: 
Your target system. 

Emulation probe. 


Logic analyzer, if you are using one. 
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Additional Information Sources 


Additional Information Sources 


Additional or updated information can be found in the following places: 


Newer editions of this manual may be available. Contact your local Agilent 
Technologies representative. 


If you ordered an emulation solution, the manual supplied with your inverse 
assembler will provide additional information. 


If you have an analysis probe, the instructions for connecting the probe to 
your target microprocessor are in the analysis probe documentation. The 
documentation supplied with the analysis probe provides information about 
using the analysis probe and emulation probe together. 


Application notes may be available from your local Agilent representative or 
on the World Wide Web at: 


http://www. agilent.com/find/emulator 


If you have an Agilent 16700-series logic analysis system, the online help for 
the Emulation Control Interface has additional information on using the 
emulation probe. 


The measurement examples include valuable tips for making emulation and 
analysis measurements. You can find the measurement examples under the 
system help in your Agilent 16700-series logic analysis system. 


The latest firmware versions and additional utilities can be found on the World 
Wide Web at http://www.cos.agilent.com/probe. 
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Designing a Target System for an 
Emulation Probe 


Chapter 2: Designing a Target System for an Emulation Probe 


This chapter will help you design a target system that will work with the 
emulation probe. 


Target System Requirements 


QACK signal (PowerPC 603, 603e, 7XX) 


Important 


If the target development board does not use the QACK signal, the board must 
have a pull down resistor to pull this signal low. This allows the PowerPC to 
enter the debug state. Recommended value: 1 kQ or less. 


If the target system uses reduced pinout mode, QACK must be high during 
HRESET, but must be low to enter debug mode. If neither QACK or QREQ are 
being used, these two pins can be tied together and pulled high with a 1 kQ 
pullup. If QACK or QREQ are used by the target system, logic must be 
supplied to make QACK low after QREQ is asserted so that the PowerPC can 
enter debug mode. 


TDO, TDI, TCK, TMS and TRST signals 


TDO, TDI, TCK, TMS and TRST signal traces between the JTAG debug port 
connector and the processor must be less than 3 inches long. If these signals 
are connected to other nodes, the other nodes must be daisy chained between 
the JTAG connector at one end and the PowerPC microprocessor at the other 
end. These signals are sensitive to crosstalk and must not be routed along 
active signals such as clock lines on the target board. 


The TDI, TCK, TMS and TRST signals must not be actively driven by the 
target system when the JTAG debug port is being used. 


Reset Vector Address 


After a system reset, the processor can be directed to boot from one of two 
locations. This allows the developer flexibility in booting from either ROM or 
RAM. 
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You can choose the start location after a reset by using the reset operation 
configuration command (see page 79) and the reset vector configuration 
command (see page 81). The location can be fff00100 (the traditional location 
of ROM) or 00000100 (a RAM reset location). The use of a RAM location 
allows you to rapidly re-compile, load, and then test your boot-up sequence 
without having to re-flash ROM. 


Halt and Reset signals 


PowerPC 4XX. HALT is an open-collector (open-drain) signal. The 
emulation probe monitors this signal and drives it with an open-collector 
(open-drain) output. The signal on the JTAG/COP connector should be wire 
ORed with the target system drivers for this signal. 


PowerPC 6XX/7XX. There are three reset signals on the JTAG/COP 
(Common On-chip Processor) Connector. 


HRESET and SRESET (or HALT on 4XX processors) are open-collector 
(open-drain) signals. The emulation probe monitors these signals and drives 
them with an open-collector (open-drain) output. The signals on the JTAG/ 
COP connector should be wire ORed with the target system drivers for these 
signals. 


TRST is the TAP (Test Access Port) reset for the processor’s internal JTAG/ 
COP functions. The probe actively drives this signal and it should be logically 
ORed with any target system drivers for this node. 
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PowerPC 6XX/7XX Target System PC Board 


TAP 
reset 


SRESET 


JTAG Port 


TRST 


HRESET 


@ ___ SRESET 


TARGET 
PROCESSOR 
Power-up HRESET oe 
reset e HRESET 


circuit 


Hard reset HRESET 
pushbutton 


Soft reset SHEL 


The emulation probe adds capacitance to all target system signals routed to 
the JTAG debug port connector. This added capacitance may increase the rise 
time and/or fall time of the reset signals beyond target processor 
specifications. Decreasing the value of the pull-up resistor on a line will 
decrease its rise time. 


Consult the following sources for more information: 


e See the tables on pages 31 and 32 for recommended pull-up resistor 
values. 
e See the tables on page 168 for emulation probe input and output 
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capacitance values. 
e See the processor manufacturer’s data sheet for rise/fall time 
specifications. 


PowerPC JTAG interface connections and resistors 


The target system must have a 16-pin male 2x8 header connector with 
dimensions as shown below. 


JTAG Header Connector (top view) 


Position 14 of the connector on the target system must not contain a pin. The 
cable supplied with the emulation probe can only be installed if pin 14 has 
been removed from the target system header. 


Place the connector as close as possible to the processor to ensure signal 
integrity. 
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PowerPC 4XX Target Header Connections 


Header Pin 


Processor 
Number 


Signal Name 1/0 Board Resistor 
TDO Out 

Not connected 

TDI In 10 kQ pullup 


Not connected ! 
Not connected 


+POWER 2 1 kQ series 3 
TCK In 10 kQ pullup 
Not connected 

TMS In 10 kQ pullup 
Not connected 

HALT In 10 kQ pullup 
Not connected 

Not connected 

KEY 

Not connected 

GND 


COo;NM | GH) o &}w)Nm|— 


(ce) 


—}|/—|/ =| =|] =|] =] = 
OD} ol] &}] CG} NM] —| © 


! Pin 4 should be connected to TRST on the PowerPC 405GP/405CR processors, and should be 
pulled up with a 10 kQ resistor. PowerPC 401/403-based processors do not have a TRST pin. 


? The +POWER signal is sourced from the target system and is used by the emulation probe as 
a reference signal. It should be the power signal being supplied to the processor (in the range 
of 2.0 V to +5.0 V). It does not supply power to the emulation probe. 


3 This 1 kQ series resistor provides short circuit current limiting protection only. Ifthe resistor 
is present, it should be 1 kQ or less. 
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PowerPC 6XX/7XX Target Header Connections 


Header Pin Processor 
Number Signal Name 1/0 Board Resistor 
1 TDO Out 
2 Not connected 
3 TDI In 1 kQ pulldown ! 
4 TRST In 10 kQ pullup 
5 Not connected 
6 +POWER 2 1kQ series ° 
7 TCK In 10 kQ pullup 
8 Not connected 
9 TMS In 10 kQ pullup 
10 Not connected 
11 SRESET In 10 kQ pullup 
12 Not connected 
13 HRESET In 10 kQ pullup 
14 KEY 
15 CHECKSTOP or CSTP_OUT Out 10 kQ pullup 
16 GND 
Other target connections: 
OACK 4 In 1 kQ pulldown 
L2_TEST_CLK In 10 kQ pullup 
L1_TEST_CLK In 10 kQ pullup 
LSSD_MODE In 10 kQ pullup 
ARRAY_WR In 10 kQ pullup 


' This 1kQ pulldown resistor ensures target system stability when the emulation probe is 
disconnected from the target header. Alternatively, a 10 kQ pullup resistor can be used if 
desired. 


? The +POWER signal is sourced from the target system and is used as a reference signal. It 
should be the power signal being supplied to the processor (in the range of 2.0 V to +5.0 V). It 
does not supply power to the emulation probe. 


3 This 1 kQ series resistor provides short circuit current limiting protection only. If the resistor 
is present, it should be 1 kQ or less. 


4 Ifthe target system does not use QACK, the board must have a 1 kQ pulldown resistor 
connected to this pin. This signal allows the emulation probe to force the processor into soft 
stop mode. Ifthe target system does use this signal, it should provide logic so that QACK goes 
low in response to a QREQ. 
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See Also 
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To choose a point-to-point or site LAN connection 


You need to set up aLAN connection for the E5900B emulation probe, even if you 
are using an E5901B emulation module. 


The emulation probe has an IEEE 802.3 Type 10/100Base-TX LAN connector. 


The emulation probe is compatible with both 10 Mbps (1LOBASE-T) and 100 
Mbps (100BASE-TX) twisted-pair ethernet LANs. The probe automatically 
negotiates the data rate for the LAN it is connected to. 


Before the Emulation Control Interface can connect to the emulation probe, 
the probe’s LAN parameters (that is, its IP address, gateway address, and 
subnet mask) must be set up. The IP address and other network parameters 
are stored in nonvolatile memory within the emulation probe. 


For information on connecting a debugger to the emulation probe, see 
Chapter 8, “Using the Emulation Probe,” beginning on page 81. 


To choose a point-to-point or site LAN 
connection 


You can connect the emulation probe to your site LAN, or you can create an 
isolated network between a 16700-series logic analysis system and the 
emulation probe using a point-to-point connection. 


A point-to-point connection is especially useful when you 
have a 16700-series logic analysis system, and: 


e You do not have a site LAN, or 

e The measurement setup will be on a cart, or 

e You do not want to connect the measurement setup to a LAN because of 
security reasons. 
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Advantages of a point-to-point connection: 


If you have an E5901B emulation module, all LAN parameters will be set 
automatically. 

No need for a system administrator to assign IP addresses. (You can use 
any IP address for the emulation probe, and it will not conflict with other 
devices on the LAN.) 

The logic analysis system cannot be accessed across the network (required 
in some high-security environments). 

Can be used when a site LAN is not available. 


Disadvantages of a point-to-point connection: 


Neither logic analysis system nor the emulation probe are connected to a 
site LAN. 
A special "crossover" LAN cable must be used. 


If you have an emulation module, use the LAN crossover cable supplied 
with the emulation module (Agilent part number 5061-7342). If you do not 
have an emulation module, use a Category 3 (for 1OBASE-T) or Category 5 
(for LOOBASE-TX) crossover cable. 


The emulation probe must be near the logic analysis system. The length of 
the crossover cable supplied with the emulation module is 1.5m (5 feet). 
Remote file systems cannot be mounted for access to source code files, 
symbol files, or executable files. 

The emulation probe cannot be controlled by a debugger on a host 
computer. 


Connection Method Go to Page 
Site LAN connection page 40 
Point-to-point page 49 
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Connecting the Emulation Probe to a Site LAN 


1 Connect the LAN cable to the connector on the emulation probe. 


Be sure to use the appropriate Category 3 or Category 5 cable for your LAN. 
Do not use the LAN cable supplied with the emulation probe—it is a crossover 
cable used for point-to-point connections only. 


2 Find out the IP address and other LAN parameters to use for the 
emulation probe. See “To obtain an IP address” on page 41. 


3 Decide how you want to configure the LAN parameters: 


If you have this equipment... Use this procedure 


Emulation probe only “To configure LAN parameters using a serial 
connection” on page 42, or 
“To configure LAN parameters using DHCP” 


on page 45 
Emulation probe and a logic “To configure LAN parameters using a logic 
analysis system without an analysis system without an emulation module” 
E5901B emulation module on page 47 
Emulation probe and a logic “To configure LAN parameters using a logic 
analysis system with an E5901B — analysis system with an emulation module” on 
emulation module page 48 


4 Verify that your emulation probe is now active and on the network. See 
"To verify LAN communications" on page 51. 
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To obtain an IP address 


1 Obtain the following information from your local network administrator 
or system administrator: 


e An IP address for the emulation probe. 


You can also use a "LAN name" for the emulation probe, but you must 
configure it using the integer dot notation (such as 127.0.0.1). 


e The gateway address. 


The gateway address is an IP address and is entered in integer dot 
notation. The default gateway address is 0.0.0.0, which allows connections 
only on the local network or subnet. If connections are to be made to 
workstations on other networks or subnets, this address must be set to the 
address of the gateway machine. 


e The subnet mask. 


A subnet mask blocks out part of an IP address so that the networking 
software can determine whether the destination host is on a local or 
remote network. It is usually represented as decimal numbers separated 
by periods; for example, 255.255.248.0. 


2 Find out whether port numbers 6470 and 6471 are already in use on 
your network and if that use constitutes a conflict. 


The host computer interfaces communicate with the emulation probe through 
two TCP service ports. The default base port number is 6470. The second port 
has the next higher number (default 6471). 


In almost all cases, the default numbers (6470, 6471) can be used without 
change. If necessary the base port number can be changed if the port numbers 
conflict with some other product on your network. 


To change the port numbers, see page 44. If you have already set the IP 
address, you can use a telnet connection instead of a serial connection to 
connect to the emulation probe. 
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To configure LAN parameters using a serial connection 


The E5900B emulation probe has a 9600 baud RS-232 serial interface with an 
RJ12 connector. 


The emulation probe is shipped with a serial cable (with RJ-12 connectors on 
both ends, with 6-wire straight-through connections) and an adapter (female 
RJ-12 to female 9-pin D subminiature). The adapter plugs into the 9-pin serial 
port found on most PCs. 


Serial connections on a workstation 


If you are using a UNIX® workstation as the host computer, you need to use a 
serial device file. If a serial device file does not already exist on your host, you 
need to create one. Once it exists, you need to ensure that it has the 
appropriate permissions so that you can access it. See the system 
documentation for your workstation for help with setting up a serial device. 


Serial connections on a PC 


Serial connections are supported on PCs. You must use hardware handshaking 
if you will use the serial connection for anything other than setting LAN 
parameters. 


If you are using a PC as the host computer, you do not need to set up any 
special files. 
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1 Connect the serial cable from the host computer to the emulation 
probe. 


Use the DB9-to-RJ12 adapter and the serial cable supplied with the emulation 
probe. 


2 Start a terminal emulator program on the host computer. 


If you are using a PC, the HyperTerminal application in Microsoft®Windows® 
will work fine. 


If you are using a UNIX workstation, you can use a terminal emulator such as 
cu or kermit. 


3 Configure the terminal emulator program for: 


Communication rate: 9600 baud 
Bits: 8 

Parity: none 

Stop bits: 1 

Flow control: none 


4 Turn on power to the emulation probe. 


When the emulation probe powers up, it sends a version message to the serial 
port, followed by a prompt. 


5 Press the Return or Enter key a few times. 
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You should see a prompt such as "p>" or "R>". 


For information about the commands you can use, enter ? or help at the 
prompt. 


Display the current LAN configuration values by entering the lan 
command: 


R> lan 
lan is enabled 

Link Status is UP 

100BaseTX 

lan -i 15.5.24.116 

lan -g 15.5.23.1 

lan -s 255.255.248.0 

lan -p 6470 

Ethernet Address : 08000909BAC1 
R> 


The Ethernet address, also known as the link level address, is preassigned at 
the factory, and is printed on a label on the emulation probe. 


Enter the following command: 


lan -i <internet> [-g <gateway>] [-p <port>] [-s 
<subnet >] 


The lan command parameters are: 


-i <internet> The IP address which you obtained from your 
network administrator. 


-g <gateway> The gateway address. Setting the gateway address 
allows access outside your local network or subnet. 


-s <subnet> This changes the subnet mask. 
-p <port> This changes the base TCP service port number, 
normally 6470. 


Do not change the default port numbers (6470, 6471) unless they conflict with 
some other product on your network. The numbers must be greater than 
1024. If you change the base port, enter the new value in the configuration of 
your debugger (and, for UNIX workstations, in the /etc/services file). 


Cycle power on the emulation probe. 


The IP address and any other LAN parameters you change are stored in 
nonvolatile memory and will take effect when the emulation probe is powered 
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off and back on again. 


Example 


To assign an IP address of 192.6.94.2 to the emulation probe, enter the 
following command: 


R>lan -i 192.6.94.2 


Cycle power on the emulation probe so that the new address will take 
effect. 


Verify your emulation probe is now active and on the network. See 
“Verifying LAN Communications” on page 51. 


Once you have set a valid IP address, you can use the telnet utility to connect 
to the emulation probe, and use the lan command to change LAN parameters. 


To configure LAN parameters using DHCP 


If there is a DHCP server on your network which responds to BOOTP requests 
and supports “static allocation” of IP addresses, it can be used to set the 
emulation probe’s LAN parameters. 


Ask your system administrator to set up an IP address for the 
emulation probe on the DHCP server. 


You will need to supply the link-level address of the emulation probe. 


The link-level address (LLA) is printed on a label above the LAN connector on 
the emulation probe. This address is configured in each emulation probe 
shipped from the factory and cannot be changed. 


Connect the LAN cable to the connector on the emulation probe. 
Cycle power on the emulation probe by powering it off then on again. 
Wait at least 20 seconds for the emulation probe to recognize the LAN. 


Verify that your emulation probe is now active and on the network. See 
"To verify LAN communications" on page 51. 
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What is DHCP? 


DHCP (Dynamic Host Configuration Protocol) allows clients to obtain LAN 
parameters automatically from a server. 


How does the emulation probe use DHCP? 


The emulation probe uses “static allocation” (sometimes called “manual 
allocation”) to obtain a permanent IP address. Every time the emulation probe 
is turned on, it sends out a BOOTP request packet. If the DHCP server on the 
network responds to BOOTP requests and has been configured to reply to the 
emulation probe’s link-level address, it will respond with the IP address and 
other LAN parameters. 


The emulation probe does not support “automatic allocation”, which 
permanently allocates IP addresses from a pool of addresses. 


Nor does the emulation probe support “dynamic allocation” of IP addresses— 
it does not track lease duration and request a new IP address when the lease is 
about to expire. 


How does DHCP interact with other methods of 
setting LAN parameters? 


Every time the emulation probe is turned ON, it sends out a BOOTP request 
packet (even if the LAN parameters have already been configured). As long as 
the DHCP server is configured to reply to BOOTP requests from the emulation 
probe’s link-level address, it will respond with the IP address and other LAN 
parameters. 
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To configure LAN parameters using a logic analysis 
system without an emulation module 


Connect the LAN cable to the connector on the emulation probe. 


In the logic analysis system interface, open the Workspace window by 
selecting the Workspace icon. 


| 


Scroll down the left side of the toolbox in the workspace window and 
find the emulation probe tool. Drag the emulation probe icon from the 


toolbox to the workspace. 
> Emul Probes 


“ 


co 


From the emulation probe icon, select Init Probe LAN Addresses... 


5 Enter the link-level address of the probe you wish to set up. 


Enter the internet address, gateway IP and subnet mask in the 
appropriate fields. 


Select OK. 


If "ERROR - no response from emulation probe" is displayed, check that the 
emulation probe is properly connected to the LAN. Then try selecting OK 
again. 


If no error message is displayed, the internet address and other network 
parameters will be stored in nonvolatile memory and will take effect when 
power is cycled. 


Cycle power on the emulation probe by powering it off then on again. 
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To configure LAN parameters using a logic analysis 
system with an emulation module 

Connect the emulation module to the emulation probe. (See page 35.) 
Connect the LAN cable to the connector on the emulation probe. 
Cycle power on the emulation probe by powering it off then on again. 
Wait at least 20 seconds for the emulation probe to recognize the LAN. 


From the E5901B emulation module icon, select Modify Interconnected 
Probe LAN Addresses... 


Slot 1 (255,213,221,213> | 
E5901B Emulation Module Fa 
| Start Session... 
~ Modify Interconnected Probe LAN Addresses... 


Update Firmware... 


Performance Verification... 


Help... 


Select Read Probe Addresses to read the current settings. 


Enter the internet address, gateway IP and subnet mask in the 
appropriate fields. 


Select OK. 


Cycle power on the emulation probe. The new addresses will take 
effect after you cycle power. 
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Setting up a Point-to-Point Connection 


A point-to-point connection creates an isolated network with only two 
nodes—the logic analysis system and the emulation probe. 


There are two ways to set up the connection: 


If you have this equipment... Use this procedure 


Emulation probe and a logic “To set up a point-to-point connection with an 
analysis system with an E5901B = emulation module” on page 49 
emulation module 


Emulation probe and a logic “To set up a point-to-point connection without 
analysis system without an an emulation module” on page 50 
E5901B emulation module 


To set up a point-to-point connection with an 
emulation module 


Connect the emulation module to the emulation probe (page 35). 


Connect the crossover LAN cable between the logic analysis system 
and the emulation probe. 


In the logic analysis system main window, open the System 
Administration dialog and check that networking is enabled. 


Select the emulation module icon then select Start Session... 


Slot 1 (255,213,221,213) 
E5901B Emulation Module 
yy Start Session... 
Modify Interconnected Probe LAN Addresses... 

Update Firmware... 
Performance Verification... 


Help... 


This will automatically configure the LAN connection and start the Emulation 
Control Interface. There is no need to set the IP address of the emulation 
probe. 
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To set up a point-to-point connection without an 
emulation module 


Connect the crossover LAN cable between the logic analysis system 
and the emulation probe. 


Turn on power to the emulation probe. 


In the logic analysis system main window, select the System 
Administration icon. 


Select Network Setup.... 


5 Select Standard to turn on networking. 


10 
11 


12 
13 


Select Default Network. 


Leave the network parameters with the default values. The IP address should 
be 192.0.2.231. 


In the Network Setup dialog, select OK. 
In the main system window, select the Workspace icon. 


Drag the emulation probe icon onto the workspace. 


; Emul Probes 
> 
| 


From the emulation probe icon, select Init Probe LAN Addresses... 


Enter the link-level address of the emulation probe. 


The link-level address (LLA) is printed on a label above the LAN connector on 
the emulation probe. 


Enter the following IP address: 192.0.2.233 


Select OK then follow the instructions. 


Note about the Setup Assistant: If networking is dzsabled for the 16700-series 
logic analysis system, the Setup Assistant will guide you through the process 
of setting up a point-to-point connection. If networking is enabled, the Setup 
Assistant assumes you want to connect the emulation probe to a site LAN. 
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Verifying LAN Communications 


Verify your emulation probe is now active and on the network by issuing a 


ping or telnet command to the IP address. 


To verify LAN communications using ping 


These instructions assume you are using a PC running Microsoft Windows 95 
or Windows 98. The procedure for other operating systems is slightly different. 


1 Open an MS-DOS® window or select Start—Run.... 


2 Enter the ping command followed by the IP address of the emulation 


probe. 


Example 


Reply from 
Reply from 
Reply from 
Reply from 


ILS) 
alES 
ILS 
ILS 


5 
a 
28 
36 


C:\WINDOWS>ping 192. 
iDaliavejisaiey LSA 35 , 12.6 


6ADS a 
5 ADS 
sADS 
cA DS 


35. 512.6 


with 32 bytes 


IL Zi 2 
138: 
LBs 
LAS 3 


bytes=32 
bytes=32 
bytes=32 
bytes=32 


of data: 


time=lms TTL=254 
time=lms TTL=254 
time=lms TTL=254 
time<10ms TTL=254 


If You Have Problems If the response is something like "100% packet loss" or "Destination host 
unreachable", see “Problems with the LAN Interface” on page 171. 
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To verify LAN communications using telnet 


Verify your emulation probe is now active and on the network by 
issuing a telnet to the IP address. 


This connection will give you access to the emulation probe’s built-in terminal 
interface. 


To view the LAN parameters, enter the lan command at the terminal 
interface prompt. 


To exit from this telnet session, type Ctrl+D at the prompt. 


The best way to change the emulation probe’s IP address, once it has already 
been set, is to telnet to the emulation probe and use the terminal interface lan 
command to make the change. Remember, after making your changes, you 
must cycle power before the changes take effect. Doing this will break the 
connection and end the telnet session. 


To use telnet on a 16700-series logic analysis system, select the System 
Administration icon, select the Networking tab, then select telnet.... 


See “Problems with the LAN Interface” on page 171. 


Example 


S eGlineic 92.35.12 .,6 

R>lan 

lan is enabled 

lan -i 192.35.12.6 

lem =Gj 0.0.0.0 

lan -s 255.255.248.0 

lan -p 6470 

Ethernet Address : 08000F090B30 
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Chapter 3: Installing the Optional Emulation Module 


This chapter shows you how to install the optional emulation module in your 
Agilent Technologies 16700-series logic analysis system and how to connect 
the emulation module to an emulation probe. 


If you are not using an Agilent logic analysis system with your emulation 
probe, or if your emulation module is already installed in your logic analysis 
system frame, you may skip this chapter. 


CAUTION: Electrostatic discharge (HSD) can damage electronic components. Observe 


standard ESD precautions. Use grounded wrist straps and mats when you 
handle modules. 


You will need to set up a LAN connection for the E5900B emulation probe, even if 
you are using an E5901B emulation module. 
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To install the emulation module in an Agilent 16700- 
series logic analysis system or expansion frame 


You will need T-10 and T-15 Torx screw drivers (supplied with the emulation 
module) 


Turn off the logic analysis system and REMOVE THE POWER CORD. 
Remove any other cables (including mouse or video monitor cables). 
Turn the logic analysis system frame upside-down. 


Remove the bottom cover. 


Remove the slot cover. 


The 16700B-series logic analysis system (which is shown here) has one 
available slot. If you have a 16700A-series logic analysis system, you may use 
either of the two slots. 
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5 Install the emulation module. 


6 Connect the cable and re-install the screws. 


NOTE: The 16700B-series logic analysis system (which is shown here) has one 
available connector. If you have a 16700A-series logic analysis system, you may 
connect the cable to either of the two connectors. 


7 Reinstall the bottom cover, then turn the frame right-side-up. 


8 Plug in the power cord, reconnect the other cables, and turn on the 
logic analysis system. 


The new emulation module will be shown as an"E5901B Emulation Module" in 
the system window. 
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To connect the E5901B emulation module to the 
E5900B emulation probe 


1 Connect one end of the module/probe interconnect cable to the 


E5901B emulation module in the logic analysis system mainframe. 


2 Connect other end of the module/probe interconnect cable to the 


"Emulation Module" connector on the E5900B emulation probe. 


3 Power on the emulation probe. 


The LED next to the switch is lit when the switch is turned on and the probe is 
being supplied with power. 


Power is supplied by the 16700-series logic analysis system through the 
module/probe interconnect cable. The external power supply is not necessary 
for normal operation. 


Chapter 4, “Connecting the Emulation Probe to a LAN,” beginning on page 37. 
(You need to connect the emulation probe to the LAN, even when you are 
using an emulation module.) 


Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 59. 
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Chapter 5: Installing Software on a 16700-Series Logic Analysis System 


This chapter explains how to install the software you will need for your 
analysis probe or emulation solution. 


Installing and loading 


Installing the software will copy the files to the hard disk of your logic 
analysis system. Later, you will need to load some of the files into the 
appropriate hardware module. 


Logic analysis system or logic analyzer frame 


Install Load Logic analyzer 
CD-ROM or : : 
flexible disk Hard Disk or emulation 
ne module 


54 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 5: Installing Software on a 16700-Series Logic Analysis System 


What needs to be installed 


16700-series logic analysis systems 


If you ordered an emulation solution with your logic analysis system, the 
software was installed at the factory. 


The following files are installed when you install a processor support package 
from the CD-ROM: 

e Logic analysis system configuration files 

e Inverse assembler (automatically loaded with the configuration files) 

e Personality files for the Setup Assistant 

e Emulation module firmware (for emulation solutions) 

e Emulation Control Interface (for emulation solutions) 


The B4620B Source Correlation Tool Set is installed with the logic analysis 
system’s operating system. 
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To install the software from CD-ROM 


Installing a processor support package from a CD-ROM will take just a few 
minutes. If the processor support package requires an update to the Agilent 
Technologies 16700 operating system, installation may take approximately 15 
minutes. 


The 16700B-series logic analysis systems have internal CD-ROM drives. The 
16700A-series logic analysis systems have external CD-ROM drives. 


If your system uses an external CD-ROM drive and it is not connected, see the 
connection instructions printed on the CD-ROM package. 


If your system uses an external CD-ROM drive, turn on the CD-ROM 
drive first and then turn on the logic analysis system. Otherwise, simply 
turn on the logic analysis system. 


If the CD-ROM and analysis system are already turned on, be sure to save any 
acquired data. The installation process may reboot the logic analysis system. 


Insert the CD-ROM in the drive. 


Select the System Administration icon. | 


Select the Software Install tab. 


5 Select Install... 


Change the media type to "CD-ROM" if necessary. 

Select Apply. 

From the list of types of packages, double-click "PROC-SUPPORT." 

A list of the processor support packages on the CD-ROM will be displayed. 


For touch screen systems, double select the "PROC-SUPPORT" line by quickly 
touching it twice. 


Select the POWERPC4XX, POWERPC6XX, or POWERPC7XX package. 


If you are unsure whether this is the correct package, select Details for 
information about the contents of the package. 
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Chapter 5: Installing Software on a 16700-Series Logic Analysis System 


Select Install. 
The Continue dialog box will appear. 
Select Continue. 


The Software Install dialog will display "Progress: completed successfully" 
when the installation is complete. 


If required, the system will automatically reboot. Otherwise, close the 
software installation windows. 


The configuration files are stored in a subdirectory of /logic/configs/hp. The 
inverse assemblers are stored in /logic/ia. 

See the instructions printed on the CD-ROM package for a summary of the 
installation instructions. 


See the online help for more information on installing, licensing, and removing 
software. 


To list software packages which are installed (16700) 


In the System Administration Tools window, under the Software Install tab, 
select List... . 
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Chapter 6: Connecting the Emulation Probe to Your Target System 


This chapter shows you how to connect the emulation probe to the target 
system and how to configure the emulation probe and target. 


Here is a summary of the steps for connecting and configuring the emulation 
probe: 


Make sure the target system is designed to work properly with the 
emulation probe. (See page 25.) 


Install the emulation module in your logic analysis system, if necessary. 
(See page 31.) 


3 Connect the emulation probe to a LAN. (See page 37.) 


Connect the emulation probe to your target system using the ribbon 
cable. (See page 61.) 


Update the firmware of the emulation probe, if necessary. 
(See page 135.) 


Configure the emulation probe. (See page 69.) 


Connect a debugger to the emulation probe, if applicable. 
(See page 83.) 
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To connect the emulation probe to the target system 


The emulation probe can be connected to a target system through a 16-pin 
JTAG port connector (a 16-pin male 2x8 header connector on the target 
system). 


The emulation probe should be connected to the target system using the 
ribbon cable provided. 


Turn off power to the target system. 
Turn off power to the emulation probe. 


Plug the un-keyed end (pin 14 is open) of the ribbon cable into the 
emulation probe. 
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Plug the keyed end of the cable (pin 14 is blocked) into the JTAG 
debug port on the target system. 


Red Stripe 


Orient the red stripe away from pin 1 of the connector and towards the key 
pin. If the connector is rotated, your target system or the emulation probe may 
be damaged. 


5 Turn on power to the emulation probe. 


Turn on power to the target system. 


After you have connected the emulation probe to your target system, you may 
need to update the firmware in the emulation probe. 


For information on designing a debug port on your target board, see page 26. 


For a list of the parts supplied with the emulation probe, see page 16. 
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Chapter 7: Configuring the Emulation Probe 


The emulation probe has several user-configured options. These options may 
be customized for specific target systems. 


The easiest way to configure the emulation probe is through the Emulation 
Control Interface in an Agilent 16700-series logic analysis system. 


For more information on starting the emulation control interface, select Help... 
from the emulation probe/module icon. 


If you use the Emulation Control Interface, please refer to the online help in the 
Configuration window for information on each of the configuration options. 


Other ways to configure the emulation probe are by using: 


e The emulation probe’s built-in command line interface (see page 112.) 
e Your debugger, if it provides an “emulator configuration” window which 
can be used with this emulation probe 
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What can be configured 


Configuration options are discussed in the following sections: 


Section Title Page 
Processor type 74 
Processor version 75 
JTAG clock speed 76 
Restriction to real-time runs 78 
Reset operation 79 
Reset vector address 81 
Power on reset behavior 81 
Freeze timers option 82 
Branch folding 83 
Address validation 84 
Fast memory loads 85 
Memory model 86 
Memory read operation 87 
Data memory write operation 88 
Instruction memory write operation 89 
Memory read delay 91,92 
Memory write delay 93, 94 
Address translation 95 
Checkstop status 96 
Break in SMB port behavior 97 
Trigger out SMB port behavior 98 
Voltage reference 99 
Voltage threshold 100 
32-bit/64-bit mode 100 
Data parity 101 
Caches 102 
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Using the cf Commands 


You can configure the emulation probe using the built-in “cf” commands. 
1 Establish communications with the emulation probe over the LAN. 


You can either telnet from a networked computer or you can use the 
debugger. For more information, refer to “Connecting the Emulation Probe to 
a Site LAN” on page 40. 


Debuggers typically provide some way to enter commands in the emulation 
probe’s command line interface, or they provide a window for configuring the 
emulation probe. 


2 Enter the “c£” command to view the current configuration settings. 


Example 


pect 
cf rrt=yes 
cf reset=runrom 
c£ speed=26MHzZ 
c£ mrdop=mm 
cf dmwrop=mm 
cf imwrop=upd_ dcu 
c£ mrddel=0 
c£ mwrdel=0 
cf breakin=rising 
cf trigout=monhigh 
cf parity=off 
cf address=effective 
cf 32bitmode=off 
cfi vref=external 
cf thresh=1/2 
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3 Enter the “help cf” or “? cf? command to see a complete list of the 
configuration items that may be set. 


Example 


cf - display or set emulation configuration 


(ha - display current settings for all config items 
cf <item> - display current setting for specified <item> 
cf <item>=<value> - set new <value> for specified <item> 

cf <item> <item>=<value> <item> - set and display can be combined 
cf default - return all items to default 


help cf <item> - display long help for specified <item> 


--- VALID CONFIGURATION <item> NAMES --- 


rrt - Restrict to real-time runs 
reset - Configure reset actions 

speed - Set JTAG clock 

mrdop - Configure mem read operation 
dmwrop - Configure D mem write operation 
imwrop - Configure I mem write operation 
mrddel - Set memory read delay 

mwrdel - Set memory write delay 

breakin - Select SMB break input option 
trigout - Select SMB trigger output option 
parity - Enable/disable data parity 
address - Verify address translation 
32bitmode - Conform to 32 bit mode 

vref - Voltage reference 

thresh - Voltage threshold 


4 To see amore detailed description of any configuration item, use the 
command “help cf <item>”. 


Example 


p>help cf rrt 
Restrict to real-time runs 


cf rrt=yes 
cf rrt=no 


If yes (and while the processor is running the user program), any 
command that requires the processor to be stopped will be rejected. 
For example ‘reg’ and ‘m’. 


If no, commands that require the processor to be stopped will 
actually stop the processor, execute then resume running the 
processor. 


5 Use the c£ commands to change the configuration settings (see 
“Configuration items” on page 74). 


See Also For information on other commands, see “To use the built-in commands” on 
page 157. 
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Configuration items 


Configuration items can be changed using the various cf <item> commands 
listed in this chapter. Configuration information is stored in non-volatile 
memory, so the changes you make to the emulation probe configuration will 
remain in effect even if you cycle power to the emulation probe. 


Default configuration 


To restore the emulation probe configuration to factory default settings, issue 
the cf£ default command. 


To configure the processor type 


The emulation probe may be configured for a particular processor type: 


e by loading the appropriate firmware driver 
e by issuing the procs command 


All processors require the appropriate firmware driver. See “Updating 
Firmware” on page 135 for instructions on installing the correct firmware 
driver for your target processor. 


The cf proc command is not used. For all drivers described in this book, the cf 
proc configuration defaults to the correct value for all processors supported 
under the particular firmware driver used. 
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To configure the processor version using the procs 
command (PowerPC 740P and 750P) 


If your target processor is a PowerPC 740P/750P, you must use the procs 
command in addition to the other PowerPC 740/750 configuration commands. 
Normally the emulation probe reads the target’s Processor Version Register 
(PVR) at initialization to determine the PowerPC700 chip type. However, 
additional configuration is required when using the PowerPC 740P/750P to 
ensure that the emulation probe is correctly configured. 


Processor Command 
PowerPC 740P procs 740REV2 
PowerPC 750P procs 750REV2 


For example: 
To set the processor type to PowerPC 750P enter: 


M>procs 750REV2 


To see which processor type has been selected: 


M>procs 
740REV2/750REV2 (PVR 0x000802xx) 
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To configure the JTAG test clock (TCK) speed 
(communication speed) 


The emulation probe needs to be configured to communicate at a rate which is 
compatible with your target processor. The JTAG clock speed is independent 
of processor clock speed. 


Target systems that have additional loads on the JTAG lines or do not quite 
meet the requirements described in Chapter 2, “Designing a Target System for 
an Emulation Probe,” may require a slower TCK speed setting. 


The speed value is a number followed by either K, which indicates the value is 
in kHz, or M, which indicates the value is in MHz. The clock speed ranges are 
shown in the table that follows. Not all values in the range are valid; if an 
invalid speed is entered, the next slower valid speed will be used. 


Entering c£ speed without a value will display the current speed. 


JTAG clock speed configuration 


Command 


cf speed=value 


JTAG TCK (Test Clock) Speed Configuration 


Emulation Emulation Emulation 


Target System Probe Factory Probe Probe ehelah abel 
Processor Default TCK Minimum TCK MaximumTCK a (MHz)* 
(MHz) (kHz) (MHz) 

400 12 11 50 50 

603e 16 11 50 50 

603ei 20 512 40 5 

603ev 16 11 50 50 

740 30 11 50 50 

745, 755 16 512 40 5 

750CX 26 11 50 50 


*The Manufacturer Spec Max TCK value may be inaccurate due to mask 
revisions and other factors. The maximum TCK rate that works with your 
target system will be dependent on many factors including signal routing, 
signal integrity, and processor architecture. 
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Configuring the Emulation Probe for Maximum 
Performance 


The performance of the emulation probe depends on the speed at which it 
communicates with the target system. Better performance is obtained with 
faster communication speeds. 


Setting TCK speed 


On JTAG debug ports the communication speed is controlled by the clock 
signal TCK. This signal is generated by the emulation probe. You can set the 
speed of TCK using the Emulation Control Interface in a 16700-series logic 
analysis system or by using the c£ speed command through a telnet or 
debugger connection to the emulation probe. 


To change TCK speed, senda cf£ speed=value command to the probe. To 
restore factory defaults including speed setting, senda c£ default 
command. For more information about cf speed, sendahelp cf speed 
command to the probe. Also note that some debuggers allow the speed to be 
set from within their GUI (Graphical User Interface) or from a command file. 


When to decrease TCK speed 


Emulation probes are configured at the factory with a default TCK speed. This 
speed is suitable for most applications. However, this speed is only valid if the 
processor is running at it’s full rated speed, trace lengths from the processor 
to the JTAG connector are short (two inches or less), and there are no stubs 
on the JTAG signals. If the emulation probe cannot communicate reliably with 
the target system using the factory default speed, the TCK speed must be 
reduced. 


When to increase TCK speed 


Some target systems will allow TCK speeds greater than the default. The 
actual maximum speed for a given target system can be determined 
empirically by increasing the speed and observing whether communication to 
the target is reliable. However, please note that speeds greater than the 
default are not officially supported by Agilent or the chip manufacturer. Often 
TCK can be set to a faster speed when downloading code than when running 
code. 
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To configure restriction to real-time runs 
(All processors) 


This option enables or disables restriction to real-time runs implemented for 
all commands other than "rst", "b","s" and "r". 


Real-time Run Configuration 


Command Emulation module configured for 


cf rrt=no If the processor is running user code, a request for a 
register or memory display will put the processor in 
monitor mode, read the requested register(s), then 
restore the processor to running user code. 

(Default 603ei, 745, 755) 


cf rrt=yes If the processor is running user code, a request for a 
memory or register display will return: ERROR 647! 
Restricted to Real Time. 
(Default 400, 603e, 603ev, 740, 750) 


If your debugger allows displaying or modifying memory or registers while the 
processor is running, you must set rrt=no in order to use that feature. 
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To configure reset operation 


The reset configuration item controls the type of reset performed and the 
state of the processor after reset. The reset options available are determined 
by the specific firmware driver is being used. (See the table on page 136 for a 
list of firmware drivers.) 


PowerPC 400 Reset Configuration 


Command Effect of a reset from the emulation module 


cf reset=core A core reset resets the processor core, including the data 
and instruction caches. It does not alter the DMA 
controller, Bus Interface Unit or Serial Port (if one exists). 
The content of external DRAM is preserved since 
refreshes continue during reset. Device Control Registers 
(DCRs) are not affected by a core reset. A core resets 
stops the processor at address OxFFFFFFFC. 

cf reset=chip A chip reset resets the entire chip including the core, 
caches, DMA Controller, Bus Interface Unit and Serial 
Port (if one exists). The content of external DRAM is not 
preserved since refreshes stop during and after the reset. 
A chip reset stops the processor at address OxFFFFFFFC. 
(Default) 

cf reset=sys A sys reset resets the entire chip with the same effect as a 
chip reset. In addition, the RESET signal is driven active 
(low) for a minimum of three clock cycles. A sys reset runs 
the processor from address OxFFFFFFFC. 

cf reset=jtag A jtag reset merely resets the JTAG port on the processor. 
It does not affect any of the processor resources or its 
state. 
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Configuration items 


PowerPC 603e, 603ev, 603e2, 603P, 603ec, 603R, 740, 750, 750M, 740P, 750P, 750CX, 
750CXe Reset Configuration 


Command 


Effect of a reset from the emulation module 


cf reset=runrom 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, soft reset the processor and 
cause it to run from address OxFFFO0100. (Default) 


cf reset=runram 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, soft reset the processor and 
cause it to run from address 0x00000100. 


cf reset=rom 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, soft reset the processor and 
cause it to stop at address OxFFF00100. 


cf reset=ram 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, soft reset the processor and 
cause it to stop at address 0x00000100. 


cf reset=jtag 


Issuing the rst command will reset the JTAG interface on 
the processor. 


PowerPC 603ei, 745, 755 Reset Configuration 


Command 


Effect of a reset from the emulation module 


cf reset=run 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, and allow the processor to run. 
(Default) 


cf reset=stop 


Issuing the rst command will hard reset the processor, 
reset the JTAG interface, and cause the processor to stop 
at the reset exception vector Oxfff00100 or 0x00000100. The 
address used is determined by the vector address 
configuration item (see page 81). 
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To configure reset vector address 
(PowerPC 603ei, 745, 755) 


The reset vector address configuration item tells the emulation probe which 
reset vector the target hardware is using. This value does not set the reset 
vector. This is done by the hardware. 


Vector Address Configuration 


Command Emulation module configured for 
cf vector=fff00100 Emulation probe is told that fff00100 is the reset vector. 
(Default) 


cf vector=00000100 Emulation probe is told that 00000100 is the reset vector. 


To configure power on reset operation 
(PowerPC 745, 755) 


The power on reset configuration item determines whether the emulation 
probe asserts a rst command upon target system power up. 


Reset Configuration 


Command Emulation module configured for 


cf pwrrst=on An emulation reset command (rst) is invoked about 1/2 
second after the target power transitions on. Subsequent 
operation is determined by the "cf reset’ configuration 
item. (Default) 


cf pwrrst=off Target reset operation at the power on transition is 
controlled by target. After the target reset the target 
processor will typically start running. The emulation 
probe will not be involved with the reset or the 
subsequent run. 
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To set the freeze timers option 
(PowerPC 400) 


The freeze timers option determines how break, run, and step commands 
affect the state of timers. 


Freeze Timers Configuration 


Command Meaning 


cf frztmrs=yes A break (stop) command will stop the processor and also 
freeze its timers. 


Arun command will run the processor and will not 
change the state of the timers. 


A step command will step the processor and will not 
change the state of its timers. 


cf frztmrs=no A break (stop) command will stop the processor and will 
not change the state of the timers. 


Arun command will run the processor and unfreeze its 
timers. 


A step command will step the processor and will not 
change the state of its timers. 


(Default) 
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To enable branch folding 
(PowerPC 400) 


This configuration item controls emulation probe behavior when stepping 
through assembly language branch instructions. 


Branch Folding Configuration 


Command Meaning 


cf brfold=yes The processor is allowed to fold branches and cr logicals 
during stepping and running. 


Folding a branch results in an automatic jump to the 
branch location upon encountering a branch instruction. 
(Default) 


Note: This setting is not valid for the 401GF or for 401 
core-based processors. 


cf brfold=no The processor is not allowed to fold branches and cr 
logicals during stepping and running. 


When a branch instruction is encountered, program 
execution will stop at the branch instruction rather than 
automatically evaluating the branch instruction and 
jumping to the location specified. 
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To enable or disable address validation 
(PowerPC 400) 


The address validation option can be used to check the validity of addresses 
prior to accessing memory. 


Address Validation Configuration 


Command Meaning 


cf addrv=yes If yes, the driver checks the validity of addresses before 
it performs memory accesses. Valid memory addresses 
are either memory mapped on the chip’s internal bus or 
defined by a bank register. A memory access to an invalid 
address will return an error message. 


Note: This setting is not valid for the 401GF or for 401 
core-based processors. 


cf addrv=no If no, the driver does not check the validity of addresses. 
A memory access to an invalid address, in this case, will 
not return an error message but will cause a bus error on 
the processor. (Default) 
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To enable fast memory loads 
(PowerPC 400) 


When the emulation probe is configured for fast memory loads it ignores 
memory write coherency options (cf imwrop and cf dmwrop) in order to 
improve performance while loading memory. Instead of following the 
coherency model specified by the imwrop or dmwrop configuration entries, 
the emulation probe turns off both caches, invalidates the instruction cache 
and flushes the dcache, then begins the load. Once the load is complete, the 
cache configuration registers are returned to their original states. 


The fast memory write configuration gains much of its speed by ignoring 
unusual cases that the slower memory write function must handle. 
Specifically, fast memory load can not be used if data is not word aligned, data 
access size is not set to 4, or if the MMU or debug wait mode are enabled. If 
any of these conditions are true, slow memory write will be used regardless of 
the setting of this configuration item. 


Fast Memory Loads Configuration 


Command Meaning 
cf fastload=yes Enable fast target memory load. (Default) 
cf fastload=no Use normal memory load routine. 


The c£ fastload=no command can be issued if the user wants the load 
command to follow memory write coherency options or if there are problems 
with the fast memory write routines on particular targets. 
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To configure the memory model 
(PowerPC 603ei, 745, 755) 


You can use a cache coherency or a physical memory model for memory reads 
and writes. If both instruction and data caches are off (bits HIDO[ICE] and 
HIDO[DCE] are zero), this configuration setting has no effect and memory 
reads return the contents of physical memory. 


Memory Model Configuration 


Command Meaning 


cf memmodel=cache Use the cache coherency model. This model assumes 
instructions and data are separate, and will not occur 
within the same cache block (way). (Default) 


cf memmodel=physical __ Use only the physical model, regardless of the state of 
the cache. 
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To configure the memory read operation 
(PowerPC 400, 603e, 603ev, 603e2, 603P, 603ec, 603R, 
740, 750, 750M, 740P, 750P) 


Although PowerPC processors have one contiguous physical address space 
that can hold both data and instructions, it is necessary to differentiate 
between data spaces and instruction spaces when dealing with a memory/ 
cache coherency model during a write memory operation. 


The memory read operation configuration entry defines how the memory and 
cache interact during a memory read operation. If both instruction and data 
caches are turned off (bits ICE and DCE in the register HIDO are zero), this 
configuration setting has no effect and a memory read will always return the 
contents of physical memory. 


Memory read configuration 


Command emulation probe configured for 


cf mrdop=mm A memory read from an address that is valid in either the 
data or instruction cache will return the contents of the 
cache. Memory reads from addresses not valid in either 
cache will return the contents of the physical memory. 
(Default) 


cf mrdop=phys A memory read will always return the contents of 
physical memory. 


Using the mrdop=phys setting with the cache enabled may show data that is 
no longer valid. Use this setting only for solving cache problems where you 
really need to see the contents of physical memory. For general operation, the 
"mm" setting should always be used. 


The instruction cache in PPC740 and PPC750 is encoded. The emulation 
probe will decode the content of the instruction cache before displaying it. 
However, the emulation probe will only decode valid instructions. Invalid 
instructions in the cache will be displayed in coded form, which might not 
match the content of memory. 
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To configure data memory write operations 
(PowerPC 400, 603e, 603ev, 603e2, 603P, 603ec, 603R, 
740, 750, 750M, 740P, 750P) 


Although the PowerPC processor has one contiguous physical memory 
address space that can hold both data and instructions, it has separate caches 
for instructions and data. These separate caches must be considered in order 
to keep the caches and memory coherent during memory write operations. 


These settings are only used for data memory write operations. Code 
download always writes to physical memory and disables any cache entries 
containing addresses written for improved performance. Some host interfaces 
use the code download mode for all memory write operations so this setting 
may or may not have any effect on your debugger. 


Only the memory write command allows specifying instruction or data 
memory operations. This may not be provided by your debugger interface. If 
not specified, memory write operations are always instruction memory. 


If the data cache is disabled, a data memory write will always write to physical 
memory and this configuration setting is ignored. 


Data memory write configuration 


Command emulation probe configured for 


cf dmwrop=mm Data writes to addresses that are valid in the data cache 
will write the value only to the cache and mark the cache 
line modified as "dirty", which will indicate to the CPU that 
the cache line must be written to memory. A data write 
that is not valid in the data cache will only be written to 
physical memory. (Default) 


cf dmwrop=thru A data memory write to an address that is valid in the 
data cache will write to both cache and physical memory. 
If the address is not valid in the cache, only physical 
memory will be modified. 


cf dmwrop=bypass A data memory write will only be written to physical 
memory, ignoring the cache. 


The cf dmwrop=bypass setting should be used with extreme caution because 
dirty cache entries may be written by the processor over the new data value 
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written to memory by the emulation probe. 


To configure instruction memory write operations 
(PowerPC 400, 603e, 603ev, 603e2, 603P, 603ec, 603R, 
740, 750, 750M, 740P, 750P) 


Although the PowerPC processor has one contiguous physical memory 
address space that can hold both data and instructions, it has separate caches 
for instructions and data. These separate caches must be considered in order 
to keep the caches and memory coherent during memory write operations. 


These settings are only used for instruction memory write operations. Code 
download always writes to physical memory and disables any cache entries 
containing addresses written for improved performance. Some host interfaces 
use the code download mode for all memory write operations so this setting 
may or may not have any effect on your debugger. 


Only the memory write command allows specifying instruction or data 
memory operations. Access to this may not be provided by your debugger 
interface. If not specified, memory write operations are always instruction 
memory. 


If the instruction and data caches are both disabled, an instruction memory 
write will always write to physical memory and this configuration setting is 
ignored. If the instruction cache is disabled, instruction memory writes will 
always write to physical memory and the data cache will be either updated or 
bypassed, depending on this configuration setting. 


This configuration setting controls the behavior of both caches when doing 
instruction memory writes so that instruction memory writes can be used for 
all memory operations, if desired. 
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Instruction Memory Write Configuration 


Command Emulation Probe configured for 


cf imwrop=upd_dcb This stands for instruction cache update, data cache 
bypass. An instruction memory write to an address that is 
valid in the instruction cache will write the value to both 
the instruction cache and memory. The data cache will 
be bypassed even if the address is valid in the data 
cache. 


cfimwrop=upd_dcu __ This stands for update instruction cache and update data 
cache. An instruction memory write to an address that is 
valid in both caches will write the value to both caches 
and physical memory. (Default) 


imwrop=inv_dcb This stands for instruction cache invalidate and data 
cache bypass. An instruction memory write will 
invalidate the instruction cache if valid and write only to 
physical memory. The data cache is not modified even if 
valid. 


imwrop=inv_dcu This stands for instruction cache invalidate and data 
cache update. An instruction memory write will 
invalidate the instruction cache if valid and write to 
physical memory. The data cache will also be updated if 
the address is valid in the data cache. 
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To set the memory read delay clock cycles 
(PowerPC 6038ei, 745, 755) 


The memory read delay is provided for accessing slow devices like memory 
mapped I/O. 


The memory read delay delays all memory reads the amount of time 
calculated using parameters entered by the user. The user specifies the core 
clock frequency. The user adjusts the delay with the number of clock cycles 
entered. 


The number of clock cycles should be set to the smallest number possible for 
best performance since it delays all memory reads by the amount of time 
calculated. 


Memory Read Delay Clock Cycles 


Command 


cf mrddelcyc= <clock cycles> @ <core clock speed> 


Example: cf mrddelcyc=300@400 
This delays all reads 750 ns (300 cycles at 400 MHz). 


Values 


0-4 000 000 000 clock cycles @ 100-700 MHz core clock speed. 
(Default = no delay) 
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To set the memory read delay time 

(PowerPC 6038e, 603ev, 603e2, 603P, 603ec, 603R, 740, 
750, 750M, 740P, 750P) 

The memory read delay setting delays the number of microseconds specified 


during memory reads. It is provided for accessing slow devices like memory 
mapped I/O. 


The delay should be set to the smallest number possible for best performance 
since it delays all reads by the number of microseconds specified. 


Memory Read Delay Time 


Command 


cf mrddel= <delay in microseconds> 


Example: cf mrddel=100 (creates 100 usec delay). 


Values 


0-10 000 000 (Default = no delay) 
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To set the memory write delay clock cycles 
(PowerPC 603ei, 745, 755) 


The memory write delay is provided for accessing slow devices like memory 
mapped IO. 


The memory write delay delays all memory writes the amount of time 
calculated using parameters entered by the user. The user specifies the core 
clock frequency. The user adjusts the delay with the number of clock cycles 
entered. 


The number of clock cycles should be set to the smallest number possible for 
best performance since it delays all memory writes by the amount of time 
calculated. 


Memory Write Delay Clock Cycles 


Command 


cf mwrdelcyc= <clock cycles> @ <core clock speed> 


Example: cf mwrdelcyc=300@400 
This delays all writes 750 ns (300 cycles, at 400 MHz). 


Value 


0-4 000 000 000 clock cycles @ 100-700 MHz core clock speed. 
(Default = no delay) 
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To set memory write delay time 

(PowerPC 6038e, 603ev, 603e2, 603P, 603ec, 603R, 740, 
750, 750M, 740P, 750P) 

The memory write delay setting delays the number of microseconds specified 


during memory writes. It is provided for accessing slow devices like memory 
mapped I/O. 


The delay should be set to the smallest number possible for best performance 
since it delays all writes by the number of microseconds specified. 


Memory Write Delay Time 


Command 


cf mwrdel= <delay in microseconds> 


Example: cf mwrdel=100 (creates 100 sec delay). 


Values 


0-10 000 000 (Default = no delay) 
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To configure address translation 
(PowerPC 603e, 603ei, 603ev, 603e2, 603P, 603ec, 603R, 
all 7XX) 


You can enable or disable address translation in the emulation probe. 


Address translation configuration 


Command Meaning 


cf address=effective If the MMU is enabled, addresses are verified for proper 
translation and the corresponding physical address is 
used instead. (Default) 


cf address=physical Physical addresses are used, even if the MMU is 
enabled. 


When the MMU is enabled (MSR[IR] or MSR[DR] is set), and the emulation 
probe is configured for effective addresses, all memory addresses given to the 
emulation probe are assumed to be effective addresses (logical addresses). 
The emulation probe uses the MMU block address translation (BAT) registers, 
segment registers, hash tables, and other special-purpose MMU registers to 
compute each corresponding physical address. The requested memory 
operation is then performed using the physical address. 


Operational notes: 


e The emulation probe attempts to perform address translation only if the 
MSR[IR] and/or the MSR[DR] bits are set (=1) AND the emulation probe is 
configured to do translation (c£ address=effective). 


e Ifboth the MSR[IR] and MSR[DR] are set, the emulation probe will perform 
address translations by first searching the IBAT registers and then the 
DBAT registers. Note that the PowerPC silicon allows the IBAT and DBAT 
registers to specify overlapping effective address ranges. Avoid defining 
overlapping ranges. These make debugging more difficult because the 
emulation probe can use the IBATs to translate addresses intended for the 
DBATs. 


e If an effective address is not found in the MMU translation tables, the 
emulation probe will return an error and will not perform the requested 
operation. 


e Cache coherency is maintained during emulation probe MMU translations. 
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e Be sure the translation enable/disable condition is the same when you set 
and clear breakpoints. If a breakpoint is set while translation is enabled 
and then cleared while translation is disabled, the result will be erroneous 
and unpredictable. This is also true if a breakpoint is set while translation 
is disabled and then cleared while translation is enabled. 


e The emulation probe ignores read-only restrictions defined in the MMU. 
(In other words, the emulation probe may attempt to write to memory that 
has been defined by the MMU as read-only.) 


e MMU translation is automatic and transparent to debuggers connected to 
the emulation probe. 


To configure checkstop status 
(PowerPC 603ei, 745, 755) 


The checkstop signal (CSTP_OUT on pin 15 of the JTAG connector) can be 
used to detect a checkstop condition. 


Checkstop configuration 


Command Meaning 
cf checkstop=off The signal is not polled. (Default) 
cf checkstop=on The checkstop signal is used to detect a checkstop 


condition. If a checkstop condition is detected, a prompt 
of "c>" is returned on the command line. 
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To configure the Break In SMB port 
(All processors) 
If you have an emulation probe, but you do not have an emulation module, use 


the following table to configure the behavior of the Break In SMB connector 
on the front of the emulation probe. 


When the emulation probe is connected to an emulation module via the 
module/probe interconnect cable, this configuration item is always set to rising 
for compatibility with intermodule triggering. 


If you need to break on a falling edge, either trigger from the logic analysis 
system or use the emulation probe without the emulation module. 


Break In Configuration 


Command Emulation probe Break In 


cf breakin=rising The emulation probe will cause a break into monitor ona 
rising edge. (Default) 


cf breakin=falling The emulation probe will cause a break into monitor on a 
falling edge. 
cf breakin=off Inputs to Break In will be ignored. 


There is a delay of about 400 usec between receiving the edge and stopping 
the processor. 
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To configure the Trigger Out SMB port 
(All processors) 


If you have an emulation probe, but you do not have an emulation module, use 
the following table to configure the behavior of the Trigger Out SMB 
connector on the front of the emulation probe. 


If you have an emulation module, the trigger out behavior is always set to 
monhigh for compatibility with intermodule triggering. 


Trigger Out Configuration 


Command Emulation probe Trigger Out will be 

cf trigout=monhigh Logic high when the processor is running in background. 
(Default) 

cf trigout=monlow Logic low when the processor is running in background. 

cf trigout=fixhigh Fixed logic high. 

cf trigout=fixlow Fixed logic low. 
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To configure the voltage reference (All processors) 


The emulation probe uses the Vref signal on the JTAG connector to determine 
logic high and logic low levels when driving the TDI and TCK signals. 


Voltage Reference Configuration 


Command Meaning 


cf vref=external The voltage reference is generated by sensing the 
voltage present at pin 6 (the +POWER pin) of the JTAG 
header on the target system. (Default) 


cf vref=value The voltage reference of value is generated internally by 
the emulation probe. The value is a number followed by 
either mV, which indicates the value is in millivolts, or V, 
which indicates the value is in volts. 


This option should only be used if the core voltage is different than that of the 
Vref (+POWER) signal on the JTAG connector. Use this option with extreme 
care, because it is possible to damage the target system if the voltage level is 
chosen incorrectly. 
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To configure the voltage threshold (All processors) 


Threshold for voltage reference. Voltages above (Vref ¢ thresh) will be 
considered logic high and voltages below this level will be considered logic 
low. 


Voltage Threshold configuration 


Command Meaning 

cf thresh=1/2 Threshold voltage is set to 50% of Vref. (Default) 
cf thresh=2/3 Threshold voltage is set to 67% of Vref. 

cf thresh=1/3 Threshold voltage is set to 33% of Vref. 


To configure 32-bit mode 
(All processors except PowerPC 4XX) 


You can enable or disable 32-bit mode. 


32-bit mode configuration 


Command Meaning 

cf 32bitmode=off Normal, 64-bit mode. (Default) 

cf 32bitmode=on The maximum memory access size is forced to 32 bits. Do 
not enable this option unless it is specifically supported 
by your target system. 
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To enable or disable data parity 
(PowerPC 603e, 603ev, 603e2, 603P, 603ec, 603R, 740, 
750, 750M, 740P, 750P) 


The PowerPC processor generates parity bits on both address and data lines 
when running user code. When used in debug mode these bits must be 
generated separately, which slows down memory operations. Since memory 
operations on the PowerPC are already slow and many target systems do not 
check parity, the default for this configuration item is "off." 


Parity configuration 


Command Emulation probe configured for 


cf parity=off Do not generate the parity bits for memory operations 
from the emulation probe. This provides better 
performance, but will not work correctly when accessing 
devices that check the parity bits. (Default) 


cf parity=on Generate the parity bits for memory operations. Currently, 
only parity bits for the memory data lines are generated. 
Parity bits on the address lines are not. This may change 
in future firmware versions. 
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To enable or disable processor caches 


The PowerPC 7XX processors have instruction and data caches. Debugging 
using a third party debugger will have the greatest performance if the caches 
are disabled during debugging. There are three ways to disable the caches 
prior to a debug session: 


Clear bits HIDO[ICE] and HIDO[DCE]. This will turn off the instruction 
and data caches. Also turn off the L2 Cache, by setting L2CR to zero. 


Ensure that your startup code does not reset the HIDO or L2CR registers 
because this could re-enable the caches. 


(PowerPC 740/750 Only) Issue the following probe commands: 
"cf reset=rom" 
"rst" "rst" will turn off all caches) 


Ensure that your startup code does not reset the HIDO register after the "rst" 
command because this could re-enable the caches. 


(PowerPC 740/750 Only) Keep the caches enabled but tell the 
emulation probe to bypass them. To do this, issue the probe 
commands: 


"cf mrdop=phys" (so only physical memory is read) 
"cf dmwrop=bypass" (to bypass the updating of the data cache) reference 
all addresses with the @dmem modifier. 


Example 


M> cf mrdop=phys 

M> cf dmwrop=bypass 

M> m -d4 -a4 0.. (this will read physical memory only) 

M> m -d4 -a4 0O@dmem=12345678 (this will write physical memory only) 


When caches are bypassed, all memory accesses occur out of physical 
memory and the cache information is ignored. This means that cache 
coherency is not maintained. 


If cache handling is not modified using one of the above three methods, execution 
with the third party debugger may be slower due to the emulation probe making 
sure the cache information stays coherent with physical memory. 
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To enable or disable processor caches 


PowerPC 6XX and 7XX processors have instruction and data caches. 
Debugging using a third party debugger will have the greatest performance if 
the caches are disabled during debugging. 


To turn off the caches clear bits HIDO[ICE] and HIDO[DCE]. This will turn off 
the instruction and data caches. You may need to ensure that your start up 
code does not enable the caches. 


You may also debug with the caches enabled. To achieve maximum 
performance you should disable and invalidate the caches while downloading 
a program. You can do this by setting bits HIDO[ICFI] and HIDO[DCFI]. After 
downloading a program you may want to enable the caches by setting bits 
HIDO[ICE] and HIDO[DCE]. 


Performance will be slower when debugging with the caches enabled due to 
the emulation probe making sure the cache information stays coherent with 
the physical memory. 


In addition, PowerPC 750/755 processors have L2 cache. Set L2CR=0 to 
disable the L2 cache to achieve the fastest performance when debugging. 


To invalidate the L2 cache, set L2CR[L2]]. Refer to the processor user’s guide 
for instructions on enabling the L2 cache. 


PowerPC 4XX processors have instruction and data caches. Refer to the 
processor user’s guide for instructions on enabling and disabling caches. The 
debugger software will run fastest when caches are disabled. 
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Using the Emulation Probe 


The emulation probe can be controlled through the following interfaces: 


e A third-party debugger. This is the most practical interface to use with the 
emulation probe. See page 83. 

e The emulation control interface of an Agilent Technologies 16700-series 
logic analysis system. See page 85 or 86. 

e The emulation probe’s command line interface. This low-level interface is 
generally used only for troubleshooting. See page 112. 


Before you can use the Emulation Probe you must: 


Connect the emulation probe to a LAN. See “Connecting the Emulation 
Probe to a LAN” on page 37. 


Connect the emulation probe to your target system. See “To connect 
the emulation probe to the target system” on page 61. 


Configure the emulation probe for your target system. See “Configuring 
the Emulation Probe” on page 69. 


Confirm that the emulation probe is working with your target. 


To confirm that the emulation probe can communicate with your target 
system, try a few simple commands using the emulation probe’s command line 
interface. Instructions for using the command line interface are on page 157. 
You can read registers, read memory, or run a simple NOP loop. See page 151 
and page 163 for examples. 


If the emulation probe can not control the target system, see Chapter 12, 
“Troubleshooting the Emulation Probe,” beginning on page 147. 


When using the emulation probe with a 16700-series logic analysis system, the 
display can be exported to a web browser, a workstation, or a personal 
computer (PC). 


82 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 8: Using the Emulation Probe 
Using the Emulation Probe with a Debugger 


Using the Emulation Probe with a Debugger 


Several prominent companies design and sell state-of-the-art source 
debuggers that work with Agilent emulation modules and emulation probes. 


Benefits of using a debugger 


The debugger will enable you to control the execution of your processor from 
the familiar environment of your debugger. Using a debugger lets you step 
through your code at the source-code level. 


With a debugger connection, you can set breakpoints, single-step through 
source code, examine variables, and modify source code variables from the 
debugger interface. The debugger can also be used to download executable 
code to your target system. 


Using a debugger to connect to the emulation probe allows the entire design 
team to have a consistent interface from software development to hardware/ 
software integration. 


Debugger interfaces must be ordered directly from the debugger vendor. 


Compatibility with other logic analysis system tools 


You can use your logic analysis system to collect and analyze trace data while 
you use your debugger. You can use a web browser to display the logic 
analyzer windows right next to your debugger. 


Minimum requirements 
To use a debugger with the emulation probe, you will need: 


e A debugger which is compatible with the emulation probe 


e ALAN connection to the PC or workstation that is running the debugger 
See Chapter 4, “Connecting the Emulation Probe to a LAN,” beginning on 
page 37. 


e A web browser or X windows or an X terminal emulator, such as Reflection 
X ona PC. This is required only if you wish to have the logic analysis 
system user interface displayed on your PC or workstation screen, along 
with the debugger. 
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Is your debugger compatible with the emulation probe? 
Ask your debugger vendor whether the debugger can be used with an Agilent 
emulation module or emulation probe. 


Compatibility with the Emulation Control Interface 


Do not use the Emulation Control Interface at the same time as a debugger. 
The Emulation Control Interface and debuggers do not keep track of 
commands issued by other tools. If you use both at the same time, the tools 
may display incorrect information about the state of the processor, possibly 
resulting in lost data. 


Connecting to an Emulation Module 


If you are using an E5901B emulation module, configure your debugger to use 
the IP address of the E5900B emulation probe, not the logic analysis system. 


You may need to tell the debugger which port number to use. The default port 
number for a debugger connection is 6470. 


Do not use the Emulation Control Interface at the same time as a debugger. 
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Using the emulation probe with a 16700-series 
logic analysis system via an emulation module 


The following instructions explain how to control the emulation probe through 
an Agilent 16700-series logic analysis system which has an emulation module 
installed. 


1 Select the emulation module icon in the System window. 


2 Select Connect to Emulator... from the menu choices. 


Select BJ} 130.29.124,156 ez 


E5901B Emulation Module 


Connect to Emulator... 
Update Firmware... 
Performance Verification... 


Help... 


3 Select the Connect to Emulator button. 
[i Connect - Emulator<1 > BEE 


No active connection: Emulation Module 1 
Connect to Discommect fron 
Emulator Emulator 


Help | Close 


4 The emulation Run Control window will appear, which lets you use the 
Emulation Control Interface. 
[fG@ Run Control - Emulator<1> |_ {Oy x! 
File Window Help 


Sec 
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Using the emulation probe with a 16700-series 
logic analysis system via a LAN connection 


The following instructions explain how to use the emulation probe via a LAN 
connection to an Agilent 16700-series logic analysis system. 
1 Select the emulation probe icon in the Workspace window. 


Emul Probes 


a 


NOTE: Use the scroll bar on the left side of the window to locate this icon. 


2 Select Connect to Emulator... from the menu choices. 
‘4 
a Connect to Emulator... 
Init Probe LAN Addresses... 
Modify Probe LAN Addresses... 
Update Firmware... 
Performance Verification... 


Help... 


About... 


Rename 


Delete 


3 Enter the emulation probe’s LAN name or IP address and select the 
Connect to Emulator button. 
[i Connect - Emulator<2> |- Of x} 


No active connection — for demo see “Help 


Emulation Probe LAN Name: a 

Connection Timeout: | 5 <4 > sec, 
Connect to Disconnect. from 
Emulator EnaniLator 


Help | Close 
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4 The emulation Run Control window will appear. 
[& Run Control - Emulator<1> BEI Eg 


File Window Help 


esesrcs 


Agilent Technologies Emulation for the PowerPC 400/600/700 87 


Chapter 8: Using the Emulation Probe 
Using the Emulation Probe Command Line Interface 


Using the Emulation Probe Command Line 
Interface 


The emulation probe has some built-in commands (also called the “terminal 
interface”) that you can use for troubleshooting, or to verify that you can 
communicate with the emulation probe. See “To use the built-in commands” 
on page 157. 


You can enter the built-in commands using: 


e A telnet (LAN) connection (see page 88). 


e The Command Line window in the Emulation Control Interface of a logic 
analysis system (see page 89). 


e A"command window" in your debugger (see your debugger software 
instructions). 


e A serial connection (see page 42). 


Establishing a telnet connection to the emulation 
probe prior to using the command line interface 
You can establish a telnet connection to the emulation probe if: 


e Ahost computer and the probe are both connected to a local-area network 
(LAN), and 


e The host computer has the telnet program (often part of the operating 
system or an internet software package). 


To establish a telnet connection: 
Find out the LAN address or LAN name of the emulation probe. 
Start the telnet program. 


If the LAN name of the emulation probe is “test2”, the command might look 
like this: 


telnet test2 
If you do not see a prompt, press the <Return> key a few times. 


To exit from this telnet session, type <CTRL>D at the prompt. 
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Using the command line interface from the logic 
analysis system 


1 Connect to the emulator. See “Using the Emulation Probe” on page 81 
for step-by-step instructions. 


2 From the Run Control menu bar select Window, 
then select the emulator, 
and select Command Line.... 


[Run Control - Emulator<1> BEE 
File Window | Help 
System - 


Run Slot 1: Emulator<1> * pigconnect from Emulator... 


MPC860 Activate Modules ai RuniiGontro lee 


Load Executable... 

Breakpoints... 

Registers... 

Memory... 

I/O... 

Memory Disassembly... 

Status/Error Log... 
a Command Line... 

Setup... 


3 The command line window will be displayed. You can enter commands 
in the “Command Input” field of the Command Line window. 
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Exporting the Logic Analysis System’s Display 
The Agilent 16700-series logic analysis system’s display can be exported to: 


e A web browser 
e A workstation 


e A personal computer 


To export the logic analysis system’s display to a web 
browser 
You can export the display of an Agilent 16700-series logic analysis system to 


your PC or workstation using a web browser. See the online help in your logic 
analysis system for more information. 


To export the logic analysis system’s display to a UNIX 
workstation 


By exporting the logic analyzer’s display, you can see and use the logic analysis 
system’s windows on the screen of your workstation. To do this, you must have 
telnet software and X window installed on your computer. 


On the workstation, add the host name of the logic analysis system to 
the list of systems allowed to make connections: 


xhost +<IP_address> 

Use telnet to connect to the logic analysis system. 

telnet <IP_address> 

Log in as “logic”. 

The logic analysis system will open a Session Manager window on your display. 


In the Session Manager window, select Start Session on This Display. 
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On a UNIX workstation, you could use the following commands to export the 
display of a logic analysis system named “mylogic”: 


S$ xhost +mylogic 

S$ telnet mylogic 

Trying... 

Connected to mylogic.mycompany.com. 
Escape character is ‘*]’. 

Local flow control on 

Telnet TERMINAL-SPEED option ON 


Agilent Logic Analysis System 

Please Log in as: logic [displayname: 0] 
login: logic 

Connection closed by foreign host. 


To export the logic analysis system’s display to a PC 


By exporting the logic analyzer’s display, you can see and use the logic analysis 
system’s windows on the screen of your PC. To do this, you must have telnet 
software and an X terminal emulator installed on your computer. The 
following instructions use the Reflection X emulator from WRQ, running on 
Windows 95, as an example. 


On the PC, start the X terminal emulator software. 

To start Reflection X, select the Reflection X Client Startup icon. 
Start a telnet connection to the logic analysis system. 

Log in as “logic”. 


For Reflection X, enter the following values in the Reflection X Client Startup 
dialog: 


a Inthe Host field, enter the LAN name or IP address of the logic 
analysis system. 


In the User Name field, enter “logic”. 


b 

c Leave the Password field blank. 
d_ Leave the Command field blank. 
e 


Select Run to start the connection. 


The logic analysis system will open a Session Manager window on your display. 
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3 In the Session Manager window, select Start Session on This Display. 
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Many times when a system under test fails to operate as expected, you will 
need to determine whether the failure is in the hardware or the software. 
These tests verify operation of the memory hardware in the system under test. 


Two ways to run the memory tests 


There are two methods for accessing and running the emulation probe’s built- 
in memory tests: 


e Through the Emulation Control Interface of a 16700-series logic analysis 
system 
e Using a command line interface (also called terminal interface) 


You can use the command line interface through a terminal emulator or 
through a command window in your debugger. 
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Using the memory tests with an Agilent 16700 logic 
analysis system 


Connect to the emulator. See “Using the Emulation Probe” on page 82 
for step-by-step instructions. 


From the menu bar select Window, 
then select the emulator, 
and select Memory... 


[Run Control - Emulator<1> BEE 
File Window | Help 


System - | 


Run Slot 1: Emulator<> * pisconnect from Emulator 


MPC860 Activate Modules © Run Control... 


Load Executable... 
Breakpoints... 
Registers... 


Memory... a 
I/O... 
Memory Disassembly... 
Status/Error Log... 
Command Line... 


Setup... 


Select the Memory Test... button and set up the test in the window that 
appears. 


Memory Write... 
Memory Test.. + 


Select the test type and set the parameters in the window that appears. 


For help using the memory tests select Help from the menu bar, 
then select On This Window. 
Help | 


On_ This Window 
On This Emulator 


On Main System 
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Using the memory tests from a command line interface 


You can use the memory tests from a command line interface via a telnet 
session or via the emulator command window of your debugger. You can 
initiate a telnet connection by issuing a telnet to the emulation probe’s IP 
address from a terminal window. 


See Chapter 4, “Connecting the Emulation Probe to a LAN,” beginning on 
page 37 for instructions on making a connection to the emulation probe which 
will allow you to access the emulation probe via a command line interface. 


For general memory test syntax information, enter the following command at 
the emulation probe command line interface: 


help mtest 
This will display the following help dialog: 


mtest - memory test General Help: 


mtest bp [-al/2/4/8] [-v1-4] [-r1] <start>[..<end>]=<pattern> - basic pattern 


mtest ap [-al/2/4/8] [-v1-4] [-r1] <start>[..<end>] - address pattern 

mtest rp [-al/2/4/8] [-v1-4] [-r1] <start>[..<end>]=<pattern> - rotate pattern 
mtest wl [-al/2/4/8] [-v1-4] [-r1] <start>[..<end>] - walking ones 

mtest w0 [-al/2/4/8] [-v1-4] [-r1] <start>[..<end>] - walking zeros 

mtest or [-al/2/4/8] [-v1-4] [-r0] <start>[..<end>] - oscilloscope read 

mtest ow [-al/2/4/8] [-v1-4] [-r0] <start>[..<end>]=<pattern> - osc. write 


mtest sm - summary command 


Syntax Parameters: 
-a memory access size (1,2,4,8 bytes) 
-v verbosity level (level of detail of output) 
-vl prints end summary only 
-v2 prints status at the end of each repetition 
-v3 prints status at the end of each rep. and up to 10 errors 
-v4 prints status at the end of each rep. and all errors. 


-r number of repetitions to be executed 
<start> memory test start address 

<end> memory test end address 
<pattern> pattern to be written to memory 


The following applies to the oscilloscope tests: 
Default repetitions is -r0 (repeat forever). 
Default verbosity is -vl. 

Default access size is provided by mo. 


The following applies to all other tests: 
Maximum value for repetitions is 10,000. 
Default verbosity is -v3. 

Default access size is provided by mo. 


For more details type ’? mtest <test>’ 
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Memory Test Patterns 


You can use the memory test feature of the emulation probe to perform seven 
different types of tests. Use these tests to find problems in address lines, data 
lines, and data storage. Use these tests in combination because no single test 
can perform a complete evaluation of the target system memory. 


The emulation probe provides the following memory tests: 


e Basic Pattern - to validate data read-write lines. 
e Address Pattern - to validate address read-write lines. 


e Rotate Pattern - to validate data read-write lines, and test voltage and 
ground bounce. 


e Walking Ones - to validate individual storage bits in memory. 

e Walking Zeros - to validate individual storage bits in memory. 

e Oscilloscope Read - to generate the signals associated with reading from 
memory so they can be viewed on an oscilloscope. 

e Oscilloscope Write - to generate the signals associated with writing to 
memory so they can be viewed on an oscilloscope. 


Agilent Technologies Emulation for the PowerPC 400/600/700 97 


Chapter 9: Testing Target System Memory 
Memory Test Patterns 


Recommended Test Procedure 


Two types of tests are offered for testing target memory: oscilloscope tests, 
and memory functionality tests. 


Oscilloscope Tests 
1. Connect the oscilloscope to view activity on the bits of interest. 


2. Start an Oscilloscope Read (see page 108) or Oscilloscope Write (see page 
109) test, as desired. 


The test activity will be written onto the bits you specified continuously until 
you cancel the test. 


Use both the Oscilloscope Read test and the Oscilloscope Write test to 
thoroughly check the connections of interest. 


Memory Functionality Tests 

1. Run the Basic Pattern (see page 99) test on the entire Memory Range. 
Result: 
e No Problems. Perform the Address Pattern (see page 102) test next. 


e Problems found. Refer to “If problems were found by the Basic Pattern 
test” on page 100. 


2. Run the Address Pattern (see page 102) test on the entire Memory Range. 
Result: 
e No Problems. 


e Problems found. Refer to “If problems were found by the Address 
Pattern test” on page 103. 


If no problems were found by the Basic Pattern test and the Address Pattern 
test above, you can ignore the rest of the tests. The memory in your system 
has been tested thoroughly and it is good. 
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Basic Pattern test 


The Basic Pattern test finds data bits in the specified memory range that are 
stuck high or low. It also detects data lines that may be tied to power, ground, 
or not connected at all. 


How the Basic Pattern test works 


This test writes the Pattern and the complement of the Pattern to the 
Memory Range, and then compares the values in memory with what was 
written. The complement of the Pattern and then the Pattern are then 
written, read, and compared. 


Example: 


Entering the command 
mtest bp -a4 -vl -r2 20000000..2000000f=55555555 
will produce the following memory writes and reads: 


First Second 

Write/Read Write/Read 

20000000 SSS 55555) AAAAAAAA 
20000008 AAAAAAAA SSS 5555.5 


If no errors were found, the following output would appear on your 
screen: 


M>mtest bp -a4 -vl -r2 20000000. .2000000£=55555555 
Starting: Basic Pattern Test 

Completed: Basic Pattern Test 

Summary: 2 - PASSED 


Instructions for using the Basic Pattern test 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Basic Pattern test from the command line interface, enter 
mtest bp <parameters>. To see a list of the required parameters, enter 
? mtest bp. 


For general instructions on using the command line interface see page 88. 
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Interpreting Basic Pattern test results 


Consistent errors such as a particular bit incorrect every four bytes typically 
indicate a problem with the data lines. Random or sparse errors may indicate 
hardware data memory errors—check individual locations with the Walking 
Ones and Walking Zeros tests. 


This test will halt and generate an error message if your Memory Range 
specification causes this test to be performed outside the range of valid 
memory in your target system. 


This test will not halt but it will generate an error message if it is run on ROM 
or on locations with data line or location errors. 


You can open a memory window on your logic analyzer to view the memory 
content. Expect to see the pattern and the complement of the pattern that 
was specified. 


This test will not always detect errors in the address lines. For example, if a bit in 
the address lines is stuck high or low, the Pattern Test will write to a different 
location in memory. Then the read from memory for comparison will also be 
made from that different location so the data will be correct. Use the Address 
Pattern test with this test to completely evaluate the memory range. 


If problems were found by the Basic Pattern test 


Below are two examples of problems found by the Basic Pattern test. 


Example 1: Consistent error 


Starting: Basic Pattern Test 
Error: 1 at address 00000200: 
Read BSS) (0101 0101 0101 0111) 
Expected 5555 (0101 0101 0101 0101) 
rror: 2 at address 00000204: 
Read BSS (OLO1 O10 OLO1, Oiii) 
Expected 5555 (0101 0101 0101 0101) 
rror: 3 at address 00000208: 


fea} 


{ea} 


Read Sys) 5) 7/ (0101 0101 0101 0111) 

Expected 5555 (0101 0101 0101 0101) 
Error: 

Read 

Expected 


Assume the data line bit associated with the error is stuck high. This could 
happen if the suspected data line bit were soldered to power. 
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For an additional test of suspected memory, perform the Walking Ones (see 
page 106) and Walking Zeros (see page 107) tests on the problem memory 
range. 


Example 2: Random errors 


Starting: Basic Pattern Test 
Error: 1 at address 00000200: 
Read 8000 (1000 0000 0000 0000) 
Expected 0000 (0000 0000 0000 0000) 
Error: 2 at address 000004a2: 
Read efff CALLT@ Bahai Baws aia a1) 
Expected f£fff (ALI ALL Did 1171) 
Repetition: 1 - FAILED found 2 errors 
Completed: Basic Pattern Test 
Summary: 1 of 1 - FAILED (2 errors total) 


From the above listing, we assume there are two location errors in memory. At 
location 200, there is a bit stuck high. At location 4a0, there is bit stuck low. 
Use the Walking Ones and Walking Zeros tests to verify the errors. 


There is one bit stuck high at location 200 so the Walking Zeros test will print 
one error message when it tests this location. Use the Walking Ones test to 
isolate the bit that is stuck low at location 4a0. Again, this will print only one 
error message. 
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Address Pattern test 


This test verifies that the address lines of the selected memory range are 
without error. 


How the Address Pattern test works 


This test writes the address of each memory location as data to each location. 
The data is then read back to see if it matches the address. 


The pattern written to the memory is generated at the start of the test and is 
dependent upon the start address, access size, and the number of bytes in the 
memory range. 


Depending on the last Access Size selected, subsets of the addresses may be 
written to memory. 


Example: 


If the last access size was 1 byte, address 00000001 will have 01 written 
to it, and address 00000002 will have 02 written to it. 


The data written in address 00001000 will look like this, depending on 
the last Access Size. 


1 Byte = 00001000 00 01 02 03 04 05 06 07 08 09 Oa Ob Oc Od Oe OF 
2 Byte = 00001000 1000 1002 1004 1006 1008 100a 100c 100e 


4 Byte = 00001000 00001000 00001004 00001008 0000100c 


8 Byte = 00001000 0000000000001000 0000000000001008 


The upper four bytes of an 8 Byte access size are not tested for a 4 Byte 
address. The upper four bytes will always be zeros. Use a smaller access size to 
test these locations with the Address Pattern test. 


Unless the access size is 1 Byte, the odd bits of the memory locations will not 
be tested. Use the Basic Pattern test to check the odd bits. 
Instructions for using the Address Pattern test 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Address Pattern test from the command line interface, enter 
mtest ap <parameters>. To see a list of the required parameters, enter 
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? mtest ap. 


For general instructions on using the command line interface see page 88. 


Interpreting Address Pattern test results 


This test does not ensure that the data lines or individual data locations are 
without error. If a bit is stuck in a memory location, but is stuck in the written 
value, the stuck bit will not be detected. 


You can view the memory in an analyzer memory window of a 16700-series 
logic analysis system by selecting Window <emulator> Memory.... Enter ? m at 
the command line prompt for help viewing memory using a terminal interface. 
You should see direct correlation between each address and the data stored at 
that address. 


Consistent errors typically indicate problems in the address lines. This is 
especially likely if the results of the Basic Pattern test were without errors. 


Errors in specific memory locations may indicate errors in the memory 
hardware instead of the address lines. 


If problems were found by the Address Pattern test 


You may see no errors in the Basic Pattern test, but errors in the Address 
Pattern test. For example, you might see the following result in the Address 
Pattern test: 


Example: 


Error: 1 at address 00000000: 
Read 0020 (0000 0000 0010 0000) 
Expected 0000 (0000 0000 0000 0000) 
Error: 2 at address 00000002: 
Read 0022 (0000 0000 0010 0010) 
Expected 0002 (0000 0000 0000 0010) 


You would see that the data stored at locations 00 through Of is the data that 
should be at locations 20 through 2f. This indicates an address line problem. 
Address bit 5 must be stuck low because the addresses that should have been 
written to the range 20 through 2f were written instead to 00 through Of. 


Random errors typically do not indicate address line errors. Use the Walking 
Ones (see page 106) and Walking Zeros (see page 107) tests to check the 
locations of random errors. 


Agilent Technologies Emulation for the PowerPC 400/600/700 103 


Chapter 9: Testing Target System Memory 
Memory Test Patterns 


Rotate Pattern test 


The Rotate Pattern test finds data bits in memory that are stuck high or low. It 
also detects data lines that may be tied to power ground, or not connected at 
all. This test can be used to test voltage and ground bounce problems 
associated with the selected memory range. 


How the Rotate Pattern test works 


This test writes the Pattern and the complement of the Pattern to the 
Memory Range, and then compares the values in memory with what was 
written. Next, the rotated Pattern and the rotated complement of the Pattern 
are written, read, and compared. Now the Pattern is rotated again, and again 
it is written, read, and compared. This continues until the rotations of the 
pattern return it to its original arrangement. That constitutes one Repetition 
of the Rotate Pattern test. 


Example: 


First Second “Plata rere 
Address Write/Read Write/Read Write/Read 


00000000 O1 FE 02 
00000001 FE 02 FD 
00000002 02 FD 04 
00000003 FD 04 FB 
00000004 04 FB 08 
00000005 FB 08 F7 
00000006 08 F7 10 
00000007 F7 10 EF 
00000008 iLO EF 20 


Larger Access Size selections take more time because they require more 
patterns to be written to all locations (2-byte Access Size requires writing 32 
patterns, and 4-byte Access Size requires writing 64 patterns). 


The Access Size you select will affect the appearance of memory when you 
view memory after a test. When a test is complete, memory contains the last 
set of patterns that was written to it. 
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Example: 


The following listing is from a Rotate Pattern test which was performed 
one time with an Access Size of 2 bytes, and an initial pattern of 0001. 


What you see below is the 32nd set of patterns written to memory during 
the test. 


00000000 7£EE 0001 £ffe 0002 £ffd 0004 EFfb 0008 
00000010 f£f££7 0010 f£fef 0020 £fd£ 0040 FEbE 0080 
00000020 f£7£ 0100 fef£f 0200 Fdff 0400 Ebf£f 0800 
00000030 £7££ 1000 eff£ 2000 df£f£f 4000 bf££L 8000 
00000040 7£EE 0001 f£ffe 0002 £ffd 0004 EFfb 0008 
00000050 fff£7 0010 ffef 0020 £fd£f 0040 £FbE 0080 
00000060 f££7£ 0100 fef£ 0200 FEdf£f 0400 Ebf£ 0800 
00000070 £7££ 1000 eff£ 2000 dff£f 4000 bf£f£ 8000 


Instructions for using the Rotate Pattern test 


Since the Rotate Pattern test is designed to rotate a single bit through 
memory, it is generally best to use a pattern such as 01, 0001, or 00000001. 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Rotate Pattern test from the command line interface, enter 
mtest rp <parameters>. To see a list of the required parameters, enter 
? mtest rp. 


For general instructions on using the command line interface see page 88. 


Interpreting Rotate Pattern test results 


You can open a memory window on your logic analyzer to view the memory 
content. Expect to see the pattern and the complement of the pattern that 
was specified. 


Consistent errors such as a particular bit incorrect every four bytes typically 
indicate a problem with the data lines. Random or sparse errors may indicate 
hardware data memory errors—check individual locations with the Walking 
Ones and Walking Zeros tests. 


This test will halt and generate an error message if your Memory Range 
specification causes this test to be performed outside the range of valid 
memory in your target system. 
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This test will not halt but it will generate an error message if it is run on ROM 
or on locations with data line or location errors. 


Walking Ones test 


How the Walking Ones test works 


The Walking Ones test finds data bits stuck in logical "0". This test cycles "1" 
through each bit position in memory, and checks results. It does this by 
writing and then reading a pattern sequence of ones and zeros from all 
memory locations in the range. 


Example: 


The hexadecimal values 01, 02, 04, ... are written to each location in the 
Memory Range. 


Address Ist 2nd 3rd 4th 5th 6th 7th 8th 
00000000 Qi 02 04 08 10 20 40 80 
OO0000001 02 94 O8 aO 2 40 80 al 
00000002 04 O08 da@ 20 40 80 Oi O02 
00000003 Os a0 20 40 80 Ol O2 04 
00000004 1@ 20 40 80 Oi @2 04 O08 


Ist, 2nd, 3rd, etc. are the first, second, third, etc. complete passes 
through the memory. 


Larger Access Size selections take more time because they require more 
patterns to be written to all locations (2-byte Access Size requires writing 16 
patterns, and 4-byte Access Size requires writing 32 patterns). 


Example: 


2-byte Access Size writing 16 patterns: 


Address ist 2nd 3rd 4th 5th 6th 7th 8th 9th ... 16th 
00000000 0001 0002 0004 0008 0010 0020 0040 0080 0100 ... 8000 
00000001 0002 0004 0008 0010 0020 0040 0080 0100 0200 ... 0001 
00000002 0004 0008 0010 0020 0040 0080 0100 0200 0400 ... 0002 
00000003 0008 0010 0020 0040 0080 0100 0200 0400 0800 ... 0004 
00000004 0010 0020 0040 0080 0100 0200 0400 0800 1000 ... 0008 


Instructions for using the Walking Ones test 


For help about performing a specific memory test using the Agilent 16700- 
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series logic analysis system, see page 95. 


To use the Walking Ones test from the command line interface, enter 
mtest wl <parameters>. To see a list of the required parameters, enter 
? mtest wil. 


For general instructions on using the command line interface see page 88. 


Walking Zeros test 


The Walking Zeros test finds data bits stuck in logical "1". 


How the Walking Zeros test works 


This test cycles "0" through each bit position in memory, and checks results. 


Example: 


The hex values FE, FD, FB, ... are written to each location in the Memory 
Range. 


Address Isic Dial saeicl AMela, Sicla, Giela, Pielat fShelay 
00000000 ia TD) SB} IY DY Sle 
00000001 FID) dee} ef es} IDEN 7/Ie dN, 
00000002 ies dy) dee DYE BME EV Ts END) 
00000003 ie NewieY DIEPPE EM, = EMD) «= TeNB} 
00000004 leey IDE Ye Vy END) SMB} EV 


Ist, 2nd, 3rd, etc. are the first, second, third complete pass through the 
memory. 


Larger Access Size selections take more time because they require more 
patterns to be written to all locations (2-byte Access Size requires writing 16 
patterns, and 4-byte Access Size requires writing 32 patterns). 


Example: 


2-byte Access Size writing 16 patterns: 


Address 1st and 3rd 4th 5th 6th 7th 8th Sth. ..8  Loth 
00000000 FFFE FFFD FFFB FFF7 FFEF FFDF FFBF FF7F FEFF ... 7FFF 
00000001 FFFD FFFB FFF7 FFEF FFDF FFBF FF7F FEFF FDFF ... FFFE 
00000002 FFFB FFF7 FFEF FFDF FFBF FF7F FEFF FDFF FBFF ... FFFD 
00000003 FFF7 FFEF FFDF FFBF FF7F FEFF FDFF FBFF F7FF ... FFFB 
00000004 FFEF FFDF FFBF FF7F FEFF FDFF FBFF F7FF EFFF ... FFF7 
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Instructions for using the Walking Zeroes test 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Walking Zeroes test from the command line interface, enter 
mtest w0 <parameters>. To see a list of the required parameters, enter 
? mtest w0. 


For general instructions on using the command line interface see page 88. 


Oscilloscope Read test 


How the Oscilloscope Read test works 


This test repetitively reads the present content from the Memory Range for 
the number of Repetitions specified, typically reads continuously until 
cancelled. 


The Oscilloscope Read test does not print or store the data it has read. It is 
usually used to perform timing analysis on target system memory. 


Instructions for using the Oscilloscope Read test 


Connect your oscilloscope to view signals on the lines to be tested. These will 
be the signals generated to perform read transactions from the memory in 
your target system. 


When you have finished using your oscilloscope to view the read-from- 
memory signals: 


e If you are using a 16700 logic analysis system, select the Cancel button in 
the Busy dialog box. 
e Ifyou are using the command line interface, press Ctrl+C. 


You will see an error message if your test attempts to read memory addresses 
outside the range of available memory. 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Oscilloscope Read test from the command line interface, enter 
mtest or <parameters>. To see a list of the required parameters, enter 
? mtest orhelp mtest. For general instructions on using the command 
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line interface see page 88. 


Oscilloscope Write test 


How the Oscilloscope Write test works 


This test repetitively writes your selected Pattern to the Memory Range for 
the number of Repetitions specified, typically continuously until cancelled. 


If your pattern is larger than the access size, it will be truncated to fit. If your 
pattern is smaller than the access size, it will be zero-padded to fit. 


This test does not generate error messages for unsuccessful write 
transactions, such as writes to ROM. This test is usually used to perform 
timing analysis on target system memory. 


If desired, you can open a memory window in the logic analyzer and view the 
memory where the pattern was written. If the memory is ROM or if it contains 
errors, it may not contain the pattern that was written. 


Instructions for using the Oscilloscope Write test 


Connect your oscilloscope to view signals on the lines to be tested. These will 
be the signals generated to perform write transactions to the memory in your 
target system. 


When you have finished using your oscilloscope to view the write-to-memory 
signals: 


e If you are using a 16700 logic analysis system, select the Cancel button in 
the Busy dialog box. 
e Ifyou are using the command line interface, press Ctrl+C. 


You will see an error message if your test attempts to write to memory 
addresses outside the range of available memory. 


For help about performing a specific memory test using the Agilent 16700- 
series logic analysis system, see page 95. 


To use the Oscilloscope Write test from the command line interface, enter 
mtest ow <parameters>. To see a list of the required parameters, enter 
? mtest ow. 


For general instructions on using the command line interface see page 88. 
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Firmware gives your emulation probe a “personality” for a particular processor 
or processor family. When you update the firmware in your emulation probe a 
new driver is installed in the emulation probe. The driver determines how the 
emulation probe communicates with the target system. 


Update the firmware in any one of the following situations: 


e You need to change the processor compatibility (personality) of the 
emulation probe. 

e You have an updated version of the firmware on CD-ROM. 

e An error message was displayed indicating that the firmware must be 
updated. 


The E5900B Option 060 emulation probe is factory-programmed with the 
E3477B firmware, which is compatible with the PowerPC 603e. 


The E5900B Option 070 emulation probe is factory-programmed with the 
E3454<A firmware, which is compatible with the PowerPC 740/750. 


In this manual "PowerPC' is used to refer to both the IBM PPC family of 
PowerPC processors and the Motorola MPC family of PowerPC processors. 


PowerPC 4XX/6XX/7XX Firmware Driver Compatibility 


Processor Compatibility Driver 
PowerPC 401, 403GA, 403GB, 403GC, 403GCX, 405GP, 405CR, E3495A 
NPe405H, NPe405L, all 405xx, 44044 

PowerPC 603e E3477B 
PowerPC 603ei E3477i 
PowerPC 603ev, 603e2, 603P, 603ec, 603R E3479A 
PowerPC 740, 750, 750M, 740P, 750P E3454A 
PowerPC 750CX, 750CXe E3454G 
PowerPC 745, 755 E3454B 


For a complete list of processors supported by Agilent Technologies emulation 
probes, direct your web browser to: 
http://www.cos.agilent.com/probe/processor_support.html. 
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Updating Firmware When Operating With a 
Debugger 


To display current firmware version information 


Use telnet to access the built-in "terminal interface" and use the ver 
command to view the version information for firmware currently in the 
emulation probe. 


To update firmware from the web 


To update the firmware, you must have access to the World Wide Web and a 
PC or a workstation connected to your emulation probe (through a LAN). 


Download the new firmware from the World Wide Web site at: 
http://www.cos.agilent.com/probe 


Follow the instructions on the web site for installing the firmware. 


To update firmware from a floppy disk 


Follow the instructions on the README file on the floppy disk. 


The firmware can be installed using either a PC or a workstation which can 
read PC disks. 
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Updating Firmware With a Logic Analysis 
System 


Always update firmware by installing a processor support package. This will 
ensure that the version of the Emulation Control Interface software is 
compatible with the version of the emulation probe firmware. Logic analysis 
system operating system CD-ROMS include the processor support packages; 
versions 1.51 and later will include firmware which is compatible with E5900B 
emulation probes. 


To display current firmware version information 


1 Open the Update Firmware window. 


For an emulation module: In the system window, select the emulation module 
and select Update Firmware.... 


Select 5} 15.19.3.24 


ES5901B Emulation Module 


| Connect to Emulator... 
Modify Interconnected Probe LAN Addresses... 
Update Firmware... 
Performance Verification... 


Help... 


For an emulation probe: In the Workspace window, drag the emulation probe 
icon onto the workspace then select Update Firmware.... 


Si 
P| 
=! Connect to Emulator... 
Emule 
Init Probe LAN Addresses... 


Modify Probe LAN Addresses... 
Update Firmware... 
a Pp 


Parfarmanca Varificatian 


2 Inthe Update Firmware window, select Display Current Version. 


There are usually two firmware version numbers: one for “Generics” and one 
for the personality of your processor. 


138 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 10: Updating Firmware 
Updating Firmware With a Logic Analysis System 


To update firmware using the Emulation Control 
Interface 


End any run control sessions which may be running. 
Install the processor support package from the CD-ROM. See page 62. 
Open the Update Firmware window. 


For an emulation module: In the system window, select the emulation module 
and select Update Firmware.... 


Select —> |15.19.3.24 


E5901B Emulation Module 


| Connect to Emulator... 
Modify Interconnected Probe LAN Addresses... 
Update Firmware... 
Performance Verification... 


Help... 


For an emulation probe: In the Workspace window, drag the emulation probe 
icon onto the workspace then select Update Firmware.... 


ail 


=! Connect to Emulator... 
Init Probe LAN Addresses... 
Modify Probe LAN Addresses... 
g pulse Firmware... 


Emu 


Parfarmanca Varificat ian 
In the Update Firmware window, select the firmware to load into the 
emulation module. 


Select Update Firmware. 


In about 80 seconds, the firmware will be installed and the screen will update 
to show the current firmware version. 


Agilent Technologies Emulation for the PowerPC 400/600/700 139 


Chapter 10: Updating Firmware 
Updating Firmware With a Logic Analysis System 


To update firmware for an emulation probe using the 
Setup Assistant 
The Setup Assistant is an online tool for connecting and configuring your logic 


analysis system for microprocessor and bus analysis. The Setup Assistant is 
available on Agilent 16700-series logic analysis systems. 


This menu-driven tool will guide you through the connection procedures for 
connecting the logic analyzer to an analysis probe, an emulation probe, or 
other supported equipment. It will also guide you through connecting an 
analysis probe to the target system. 


1 Install the processor support package from the CD-ROM. See page 62. 


2 Start the Setup Assistant by selecting its icon in the system window. 


3 Follow the instructions displayed by the Setup Assistant. 
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This chapter shows you how to install an Agilent E5902B emulation migration 
so that you can use your emulation probe with a new processor family. 


The E5902B emulation migration can be used with any E5900B emulation 
probe. It cannot be used with E5900A emulation probes. 


Will I need to change the target board adapter? 


A target board adapter is supplied with the emulation migration. Some target 
board adapters are compatible with more than one type of processor. 


Use the table below to determine the part number of the target board adapter 
that you already have. Then use the table to determine the part number of the 
target board adapter for the processor type that you are migrating to. If the 
part numbers are the same, you don’t need to change the target board 
adapter. 


Processor Type Use target board adapter Emulation Migration P/N 
MPC6XX E8130-66503 Agilent E5902B Option 060 
MPC7XX E8130-66503 Agilent E5902B Option 070 
MPC8XX E8130-66508 Agilent E5902B Option 080 
MeCORE E8130-66515 Agilent E5902B Option 090 
MPC82XX E8130-66503 Agilent E5902B Option 100 
MPC74XX E8130-66503 Agilent E5902B Option 110 
MIPS32/MIPS64 E8130-66516 Agilent E5902B Option 200 
ARM7/ARM9 E8130-66504 Agilent E5902B Option 300 


Steps 4 through 7 of the procedure that follows show how to replace the target 
board adapter. 


If you don’t need to replace the target board adapter, proceed to Chapter 10, 
“Updating Firmware,” beginning on page 135. 
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To install the emulation migration 


CAUTION: Electrostatic discharge can damage electronic components. Use grounded 
wrist straps and mats. 


The tools necessary for this procedure are supplied with the emulation 
migration kit. 


1 Turn off power to the emulation probe. 


2 Disconnect all cables from the emulation probe, including the power 
cord, LAN cable, serial cable, module/probe interconnect cable, and 
target cable. 


3 Remove the cover from the emulation probe: 


a Remove the 2 nuts and 2 screws from the front of the emulation 
probe. 
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b Remove the front panel. 


ce Grasp the top cover with one hand. With the other hand, pull the 
plate on the bottom of the emulation probe, so that the top cover 
slides off. 
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4 Remove the 3 nylon screws from the target board adapter. 


| 


5 Carefully lift the target board adapter from the main circuit board. 


Do not turn on power to the emulation probe when no target board adapter is 
installed. 


You cannot run performance verification tests or make any measurements 
without a target board adapter. 


6 Install the new target board adapter on the main circuit board. 
Align both connectors and press down firmly. 


7 Replace the 3 nylon screws. 
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Reinstall the cover on the emulation probe: 


a_ Slide the top cover into place. 


b Assemble the new front panel. 


ce Attach the front panel using the 2 screws and 2 nuts. 


Connect the LAN cable, module/probe interconnect cable (if you will 
be using the emulation probe with an emulation module), and the LAN 
cable to the emulation probe. Do not connect a target cable yet. 


Turn on power to the emulation probe. 
Update the emulation probe's firmware. 


See Chapter 10, “Updating Firmware,” beginning on page 135 for instructions 
on how to update firmware. 


Run the performance verification test. 
See page 178 for instructions on testing the emulation probe. 
Connect the emulation probe to your target system. 


See Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 59 for instructions on how to make this connection. 
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Chapter 12: Troubleshooting the Emulation Probe 


If you have problems with the emulation probe, your first task is to determine 
the source of the problem. Problems may originate in any of the following 
places: 

e The connection between the emulation probe and your debugger 

e The emulation module or emulation probe itself 

e The connection between the emulation probe and the target system 

e The target system 


You can use several means to determine the source of the problem: 


e The troubleshooting guide beginning on the next page 
e The status lights on the emulation probe 
e The emulation probe performance verification (PV) tests 


e The emulation probe's built-in commands 


This chapter is presented in the following sections: 


e Troubleshooting Guide 

e Status Lights 

e Using the Emulation Probe Command Line Interface 
e Problems with the Target System 

e Problems with the LAN Interface 

e Problems with the Serial Interface 

e Problems with the Emulation Module 


e Problems with the Emulation Probe 
(Running the Performance Verification tests) 


e Returning Parts for Service 
e Contacting Agilent Technologies 
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Troubleshooting Guide 


If you have trouble using the emulation probe, the following steps may help 
you identify the problem: 


Step 1: Telnet to the emulation probe 


Use telnet to connect to the emulation probe across the LAN. (For 
instructions on how to do this, see “Verifying LAN Communications” on 
page 51. 


The emulation probe must be reachable via LAN before you can use it. 


If you cannot connect to the emulation probe 


If you cannot ping or telnet to the emulation probe (“Verifying LAN 
Communications” on page 51): 


See “Problems with the LAN Interface” on page 171. 


If you need to change the LAN parameters of the emulation probe, see 
Chapter 3, “Connecting the Emulation Probe to a Site LAN,” on page 
40. 


Step 2: Check the prompt 


Once you have connected to the emulation probe, press the Enter key a few 
times and look at the prompt which is displayed. 


If a telnet connection to the emulation probe 
displays the prompt "->" 
The "->" prompt indicates that the firmware loaded into the emulation probe is 


not compatible with the "target board adapter" which is located inside the 
emulation probe. 
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Try one of the following until you get a different prompt: 
Cycle power on the emulation probe. (Turn off your target power first.) 


Check that the proper firmware is installed for the target board adapter 
or the type of emulation probe shown on the front panel of the 
emulation probe. 


The proper firmware is installed at the factory but it could accidentally be 
changed. A "ver" command will display the firmware which is currently loaded. 
Refer to “Updating Firmware” on page 135 if the firmware is incorrect. 


Run the performance verification tests. Refer to “To run the emulation 
probe performance verification (PV) tests” on page 177. 


Connection to the wrong target or connection to the target with the pins 
connected backward could potentially damage the emulation probe. Use the 
performance verification tests to validate that the emulation probe itself is 
working correctly. 


If a telnet connection to the emulation probe 
displays the prompt "?>" 


The "?>" prompt indicates that the emulation probe is having trouble talking 
to the target and it doesn’t know what state the target is in. 


Validate that the emulation probe is connect to a powered up target. 


Refer to Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 65. 


Try initializing the emulation probe with the "init -p" command. 


Some emulation probes need to read the Processor Version Register of the 
target processor as the emulation probe is initialized. 


Check the emulation probe configuration settings. 


Enter the e£ command to display the configuration settings. Note that some 
emulation probes must set the processor type with the “procs” command. 


Try defaulting the configuration with the “cf default” command. 


Decrease the JTAG communication speed. Some targets need slower 
speeds to properly communicate. 
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Use the c£ speed command. 
Check that the proper firmware is installed for this processor. 


Some PowerPC chips require different firmware to be installed for different 
mask revs or other slight differences of the processor. For example, the 
PowerPC 608ev processor requires that the E3479 firmware is installed and 
the Motorola PowerPC 608ei requires that the E3477i firmware is installed. 


Step 3: Try some simple commands to control the 
target 


The command line interface can be used to issue some simple commands to 
the emulation probe. Issue a few commands to determine whether the 
emulation probe can control the target. 

e Instructions for using the command line interface are given on page 112. 

e Some examples of commands to issue are given on page 163. 

e A list of the emulation probe’s command line prompts is given on page 158. 


If the emulation probe has problems controlling 
the target 

The emulation probe might be having problems controlling the target if you 
see messages such as: 


"Cannot break" 
"Processor is checkstopped" 
"Bad status code (0xff) received from the processor" 


Or the prompt changes to "?>" 


Problems controlling the target can be caused by a variety of conditions. 
Typically the problem is in the configuration of the emulation probe or the 
configuration of the target. 


Try the following to better control your target: 


Decrease the JTAG communication speed. Some targets need slower 
speeds to properly communicate. 


If you are using a telnet connection or a debugger command file, use the cf 
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speed command. 
Check the emulation probe’s configuration settings. 


If you are using a telnet connection, enter the e£ command to display all of 
the configuration settings. 


Check that the emulation probe is not restricted to real-time runs. 


If you are using a telnet connection or a debugger command file, use the 
cf rrt=no command. 


Restrict to real time will not allow you to access memory or registers while the 
target is running. By setting this option to no, you will be able to access the 
memory and registers while the target is running. 


Check that the target processor is configured. 


Some target systems require configuration registers on the processor to be 
initialized before the emulation probe can properly communicate with the 
target. 


For example, the MPC860 requires memory chip selects to be defined before 
the target memory can be accessed. Other processors may need their memory 
controllers initialized. 


To initialize the target processor, either run your target from reset Cif you have 
a BOOT ROM) or define a series of emulation probe commands to initialize the 
target. 


Also refer to “Using the Emulation Probe Command Line Interface” on 
page 112 for additional information about testing a target. 


Step 4: Check the emulation module 
If you are using an E5901B emulation module, select the emulation module 


icon and start the Emulation Control Interface. 


If you have problems using the emulation probe 
as an emulation module in a 16700-series logic 
analysis system 


To use the emulation probe as an emulation module in a 16700-series logic 
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analysis system you must have installed an E5901B emulation module and you 
must connect the emulation probe to the emulation module using the module/ 
probe interconnect cable. In addition, the emulation probe must be connected 
to the logic analysis system using a LAN. 


Check that the emulation probe and the logic analysis system are on 
the LAN. 


If you are using a site LAN you should be able to ping both the logic analysis 
system and the emulation probe. 


If you are using a point-to-point LAN connection you must use a special 
crossover LAN cable, such as the one supplied with the emulation module. 


The telnet window of the logic analysis system should be able to communicate 
with the emulation probe. This window can be found by selecting the System 
Admin icon in the main system window. 


Check that the emulation probe is connected to the emulation module 
with the module/probe interconnect cable. 


If this cable is connected, you should be able to display the firmware version 
from the Update Firmware window. 


Check that you have the proper processor support package installed. 


You can check this by selecting the System Admin icon in the main system 
window, then looking at the list of software packages installed. 


Test the emulation module. See page 176. 
Test the emulation probe. See page 177. 


Try using the Setup Assistant to configure your measurement setup. 


Step 5: Check your debugger connection 


If you are using a debugger, try connecting to the emulation probe. 


If you have problems using the emulation probe 
with a debugger 


Most problems are associated with not having the emulation probe and target 
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properly configured or initialized. 


Some debuggers have an initialization file that needs to be properly defined 
before a debugger can connect to the emulation probe. 


Make sure the PC or workstation where the debugger is running can 
ping the emulation probe. (See “Verifying LAN Communications” on 
page 51.) 


Initialize the emulation probe and target so that the debugger can 
connect. Refer to your debugger manual for proper initialization. 


Refer to your debugger manual for proper operation. 


Ensure that you have set “Restriction to Real Time Runs” configuration 
item correctly. See page 78. 
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Status Lights 


Emulation Probe Target Status Lights 


The emulation probe uses status lights to communicate various modes and 
error conditions. 


The following table gives more information about the meaning of the power 
and target status lights. 


O = LED is off 
@ = LED is on 


Power/Target Status Lights 


Pwr/Target : 

LEDs Meaning 

O RST No target system power, or emulation probe is not 

O DBG connected to the target system 

O RUN 

@ RST Target system is in a reset state 

O DBG 

O RUN 

O RST The target processor is in Debug Mode 

@ DBG 

O RUN 

O RST The target processor is executing user code 

O DBG 

@ RUN 

O RST Only boot firmware is good (other firmware has been 
@ DBG corrupted) 

@ RUN 

@ RST The emulation probe can no longer control the target. Reset 
@ DBG the target, then initialize the emulation probe. 

@ RUN 
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Emulation Probe LAN Status Lights 


8130215 


Yellow 


The yellow LED, on the right side of the connector, indicates LAN activity 
(receive or transmit). 


The green LED, on the left side of the connector, is lit when the LAN interface 
is operating in 100Base-Tx mode. 


Emulation Probe Power On Light 


ON/OFF ~~ 


The green LED, to the left of the power switch, is lit when the emulation probe 
is connected to a power source and the power switch is on. 
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To list the emulation probe commands 


To list the emulation probe command line mode commands enter: 


>? * 


To get help on an individual command enter 


? <command name> 


Examples 
? cf Help on configuration questions 
? c£ speed Help on configuration speed question 


To use the built-in commands 


Here are a few commonly used built-in commands: 


Useful built-in commands 


b Break—go into the background monitor state 

cf Configuration—read or write configuration options 

help Help—display online help for built-in commands 

init Initialize—init -c re-initializes everything in the emulation 
probe except for the LAN software and configuration settings 

lan configure LAN address 

m Memory—read or write memory 

reg Register—read or write a register 

mtest Memory test—test target memory system 

r Run—start running user code 

rep Repeat—repeat a command or group of commands 

rst Reset—reset the target processor 

s Step—do a low-level single step 

ver Version—display the product number and firmware version of the 


emulation probe 
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Use help command_name to see the command syntax. For example, enter 
help m to get help on the memory command. 


The prompt indicates the status of the emulation probe: 
Emulation probe prompts 


Running user program 

Running in background monitor 
No target power 

Emulation reset 

Target reset 

Checkstop 

Unknown state 


~Jo];a3}alole\c 


Examples of built-in commands 


The following examples are specific to PowerPC 6XX and 7XX processors. You 
will need to modify these examples if you are using a PowerPC 4XX target 
system. 


Examples 
To set register GPRO, and then view GPRO to verify that it was set, enter: 


R>rst -m 
M>reg GPRO=ffff 
M>reg GPRO 

reg GPRO=O0000fffE 


To break execution and then step a single instruction, enter: 


M>b 
M>s 
PC=xXxXxXXXXXX 
M> 
To determine what firmware version is installed in the emulation probe, 
enter: 


M>ver 
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rst 
b 


r 
r 100 
rrst 


To reset the target 


To break(stop) the target into debug mode 


(Background) 
To run the target 


To run the target from an address 
To run the target from reset 


Register commands 


reg 

reg PC 
reg PC 
reg PC= 


Read all of the registers 

Read the program counter 
GPRO GPR1 Read multiple registers 
200 To Set the PC to 0x200 


All register and memory values are entered as 
hexadecimal values and should not be entered with the 
leading "0x". Use values like "200", NOT "0x200". 


Memory commands 

m0O..ff Display memory from 0 through ff 

m -dl 0..ff=0,1,2,3 Write 0,1,2,3 repetitively 
through the memory 0 to ff 

Memory test commands 


? mtest 


mtest bp -al 0..ff=55 


mtest bp -a4 0..££=55555555 


Basic pattern test 
byte access 

Basic pattern test 
4-byte access 
Additional test 
information 
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To write a NOP loop into memory 


NOTE: This example is specific to the PowerPC processor family. Please adapt this 
example for the processor type you are using. 


b To stop target if not 
already stopped 

reg MSR=40 Set machine state 

reg HID0=c00 Disable caches 


m -d4 2000=60000000,4bfffffc To write NOP loop 
into memory 
reg PC=2000 To set the Pe 


To step the program 


s Step one instruction 

PC = 00002004 Shows the new location of the PC 

s 10 Step ten instructions 

2s Additional information on stepping 

? ss Additional information on source 
stepping 


To run the simple NOP program 


r 2000 Run from address 2000 

b To stop the program 

reg PC To see the location of the PC register 
r To continue running the program 


To set a software breakpoint (Memory trap replacement 
breakpoints ) 


bc -e swbp Enable Software Breakpoints 
bp -p 2004 To set a Software Breakpoint at address 


2004 
bp To review the breakpoints that are set 
r To run the program and hit the software 


breakpoint !ASYNC_STAT 603! Software 
breakpoint: 00002004 
bp -r * To remove all software breakpoints 


160 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 12: Troubleshooting the Emulation Probe 
Status Lights 


To set a hardware breakpoint (On processor breakpoint 
registers) 


(Use this type of breakpoint when debugging ROM) 


bc -d swbp Disable software breakpoints 

bec -e hwbp Enable hardware breakpoints 

be -h -p 2004 To set a hardware breakpoint at 
address 2004 

r To run the program and hit the hardware 
breakpoint !ASYNC_ STAT 601! Hardware 
breakpoint: 00002004 

bp -h -r * To remove all hardware breakpoints 

? bp To see additional bp capabilities 
(Hardware Breakpoints can be set on 
memory transactions also) 


To use command line editing 


<cntrl>-r To recall last command(s) backward 
<cntrl1l>-b To recall last command(s) forward 
? cl To show you how to do it 

cl -e To enable command line editing 
<ESC> To enter command line editing mode 


To build scripts 


To build scripts, get the script utility from our web site 
http://www.cos.agilent.com/probe. 

Download the script utility. This is a unsupported utility but it will work for 
most scripts that you may want to build. It is unsupported in that if you find a 
defect with it we may choose not to fix the defect. The source code of the 
utility is also available. The emulload utility also has the ability to download 
ELF, COFF, IEEE695 and S-record files. 


To flash memory 


This is best left to a debugger interface. 


You may also want to use the Emulation Control Interface in the logic analysis 
system to flash target ROM. 


In addition we provide some information at our Web site on how to build 
scripts to flash parts. Go to http://www.cos.agilent.com/probe and choose 
Flashing Target ROM. 
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To display the emulation probe firmware version 


ver 


See Also Use the help command for more information on these and other commands. 
Note that some of commands listed in the help screens are generic commands 
for Agilent emulation probes and may not be available for your product. 


If you are writing your own debugger, contact Agilent Technologies for more 
information. 
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Problems with the Target System 


What to check first 


Verify that the cf options are correct for your target. 


Try some basic built-in commands using the Command Line window 
from a logic analysis system or a telnet connection: 


U>rst 
R> 


This should reset the target and display an "R>" prompt. 


R>b 
M> 


This should stop the target and display an "M>" prompt. 


M>reg GPR1 
reg GPR1=00000000 
M> 


This should read the value of the rl register (the value will probably be 
different on your target system). 


M>m 0..=abcd1234 

M>m 0O.. 
00000000 abcd1234 abcd1234 abcd1234 abcd1234 
00000010 abcd1234 abcd1234 abcd1234 abcd1234 
00000020 abcd1234 abcd1234 abcd1234 abcd1234 
00000030 abcd1234 abcd1234 abcd1234 abcd1234 
00000040 abcd1234 abcd1234 abcd1234 abcd1234 
00000050 abcd1234 abcd1234 abcd1234 abcd1234 
00000060 abcd1234 abcd1234 abcd1234 abcd1234 
00000070 abcd1234 abcd1234 abcd1234 abcd1234 

M> 


This should display memory values starting at address 0. 
M>s 


This should execute one instruction at the current program counter. 


If any of these commands don’t work, there may be a problem with the design 
of your target system, a problem with the revision of the processor you are 
using, or a problem with the configuration of the emulation probe. 
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2 Check that the emulation probe firmware matches your processor. To 
do this, enter: 


M>ver 


To check the debug port connector signals 


e Check for the following logic levels on the target debug port. 


Levels with the emulation probe not connected 


HeaderPin Signal Name Level 
3 TDI Low 
oat High/Low (depends on 

4 TRST pullup or pulldown). 
6 +POWER Vpp 

7 TCK High 

9 TMS High 

11 SRESET High 

13 HRESET High 

15 CHECKSTOP High 

16 GND Low 


Levels with the emulation probe connected 


HeaderPin Signal Name 1/0 

1 TDO Toggle with "es" command 

3 TDI Toggle with "es" command 

4 TRST High, pulse low with "rst" command 
6 +POWER Vpp 

7 TCK 10+ MHz clock (default) 

9 TMS Low, pulse with "es" command 

11 SRESET High, pulse low with "rst" command 
13 HRESET High, pulse low with "rst" command 
15 CHECKSTOP High 

16 GND Low 
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To interpret the initial prompt 


The initial prompt can be used to diagnose several common problems. To get 
the most information from the prompt, follow this procedure: 


Connect the emulation probe to your target system. 
Set the default configuration settings. Enter: 


M>cf£ default 


You can enter this command at any prompt. The emulation probe will respond 
with the same information as printed by the "ver" command. 


If the response is "'ERROR 905! Driver firmware 
is incompatible with ID of attached device" 


Make sure the target interface module is connected to the cable of the 
emulation probe. Then try the "cf default" command again. 


If the initial prompt is "p>" 


Check pin 6 on header, 3.3V (Vpp). 


If the initial prompt is "M>" 


The processor entered debug mode without the help of the emulation probe. 
Is another debugger connected? 


If the initial prompt is "c>" 


Processor is checkstopped. Something caused a machine exception before the 
emulation probe connected or CHECKSTOP is being pulled or held low. 
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If the initial prompt is "?>" with "ERROR 171!" 


A bad status code (0xXX) was received from the processor. Valid status is 
0x01 or 0x05. Any other status indicates a bad scan of the instruction register. 
Check TCK, TDO, TDI, TMS, and TRST signals. Check the firmware revision. 
See “If there are random problems” on page 180 for more information on TCK 
errors. 


If the initial prompt is "U>" 


The emulation probe is scanning the instruction register correctly. Now you 
can do some more tests: 


Enter the reset command: 


U>rst 
U> 


The "U>" prompt is a good response that indicates SRESET and HRESET are 
working. Continue with "If the prompt after rst is U>". 


If the prompt after rst is "?>" with "ERROR 171!" 


A bad status code (OxXX) was received from the processor. Valid status is 
0x01. Any other status indicates bad scan of IR or failure of the reset signals. 
Verify TCK, TDO, TDI,TMS, and TRST are all changing state on an HRESET. 


If the rst command fails 


Set "cf reset=rom" (no external bus cycles used in this mode). Then enter the 
"rst" command again: 


*>scf reset=rom 
*>rst 
M> 


You can enter these commands at any prompt, shown here as "*>". 
e Ifthe prompt is "M>" with no error messages, all scans worked. We have 


control as long as we don't try to run code. Continue with "If you can get to 
the "M>" prompt. 


e [fan error message is displayed, verify that HRESET and SRESET are 
being driven. 


e Ifthe prompt is "c>", there was bad scanning of the data scan chain. Check 
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processor mask revision. 


e Ifthe prompt is "U>", the processor failed to stop soft or hard. Check reset 
lines, mask revision, processor type and firmware version. 


If the prompt after rst is "U>" 


The HRESET and SRESET lines are working. Continue with more tests: 
Enter the break command: 


U>b 
M> 


If the prompt after b is "M>" with error messages 


If you see: "ERROR 145! Unable to soft stop - freezing the processor clocks" 
the processor is hard stopped. Check the mask revision, processor type, and 
firmware version. If all of these look good, the target may not be terminating 
cycles (pending external bus cycles). Successive run ("r") and step ("s") 
commands will fail. The processor may have fetched an invalid instruction. 


Check the value of the PC (IAR): 


M>reg PC 
reg PC=xXxXxXxXxXxxx 
M> 


If the value is fff00100, the processor had a problem accessing the boot ROM 
and crashed during boot. 


Processor and/or board level reset is required to recover from "freezing 
processor clocks" -- register and memory commands should still work. 


If the prompt after b is "M>" with no error 
messages 


Everything is still working correctly. Continue with more tests: 


If you can get to the "M>" prompt 


At the "M>" prompt, check register and memory access: 


M>reg GPRO 
reg GPRO=XxXxXxXxXxxx 
M>reg GPR0=12345678 
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M>reg GPRO 
reg GPR0=12345678 
M> 


If the returned value is equal to the written value, the emulation probe 
is able to able to read and write registers correctly. 


Now enter: 


M>m -d4 -a4 0211111111, 22222222, 33333333,44444444 

M>m -d4 -a4 0.. 
00000000 11111111 22222222 33333333 44444444 
00000010 00000000 00000000 00000000 00000000 
00000020 00000000 00000000 00000000 00000000 
00000030 00000000 00000000 00000000 00000000 
00000040 00000000 00000000 00000000 00000000 
00000050 00000000 00000000 00000000 00000000 
00000060 00000000 00000000 00000000 00000000 
00000070 00000000 00000000 00000000 00000000 

M> 

e Returned value is equal to the written value implies that memory is 


working. 


e Returned value is not equal to the written value implies that memory 
control may not be initialized. Try to initialize by: 


M>c£ reset=runrom;rst;w 5 
#waiting for 5 seconds... 

U>b 

M> 


a Repeat above memory test. 

At the "M>" prompt, check the processor’s revision level: 

The target must support burst cache fill from where PC is pointing. 
Set the PC to a location in RAM. For example: 


M>reg PC=100 
M> 


Now enter: 


M>reg PVR 
reg PVR=XXxXXXXXxX 
M> 
The returned value is in the form VVVVRRrr where VVVV is the processor's 
design architecture family, and RRrr is mask revision level. 


For example reg PVR=00080202 means 740/750 Mask Revision 2.2. See 
www.cos.agilent.com/probe for a list of Processors Supported by the 
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E5902B and their related PVR values. 


If you see memory-related problems 


The following examples are specific to PowerPC 6XX and 7XX processors. You 
will need to modify these examples if you are using a PowerPC 4XX target 
system. 


Set caches and translation off: 


M>reg HIDO=0 
M>reg MSR=0 
M> 


If these commands fail, just try again. 
Now enter: 


M>m -d4 -a4 0=11111111, 22222222,33333333,44444444 
M>m -d4 -a4 0.. 

00000000 11111111 02222222 33333333 44444444 
00000010 00000000 00000000 00000000 OD0000000 
00000020 00000000 00000000 00000000 00000000 
00000030 00000000 00000000 00000000 00000000 
00000040 00000000 00000000 00000000 00000000 
00000050 00000000 00000000 OD0D000000 00000000 
00000060 00000000 00000000 00000000 OD0000000 
00000070 00000000 00000000 00000000 OD0000000 


e Ifyou do not see correct values written in memory, try increasing memory 
delay (see pages 91, 92, 93, 94). 

e Ifthe read value is not equal to the written value, the memory controller 
may not be set up correctly. 


e If the read value is equal to the written value, but you still suspect memory 
problems, the emulation probe firmware might not be working with cache. 


Enter: 


M>cf reset=rom 

M>rst 

M>m -d4 -a4 0.. 

e Read value not equal to the written value implies that reset is tied to 
memory controller. Check HRESET and SRESET for correct connections. 
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If you have memory problems running Windows NT, you may have this 
problem: 


e System normally runs in little endian mode 


e "rst" returns processor to big endian. Memory controller on target still little 
endian, so memory access doesn't work. 


Hand load a short program: 


M>m -d4 -a4 100=38210001,60000000,60000000, 4bfffff4 
M>reg GPR1=0 
M> 


This means: Add 1, GPR1, NOP, NOP, JMP .-4 
Set the PC to this program: 


M>reg PC=100 
M> 


Step, and then check the register: 


M>s 

PC=00000104 
M>reg GPR1 

reg GPR1=00000001 
M> 


This should return "reg GPR1=00000001" . 
Step some more and verify that GPR1 increments after every four steps: 


M>s 4 

PC=00000104 
M>reg GPR1 

reg GPR1=00000002 
M> 
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Problems with the LAN Interface 


If you cannot verify LAN communication 


If you cannot verify connection using the procedure in "To verify LAN 
communication", or if commands are not accepted by the emulation probe: 


1 Make sure that you have connected the emulation probe to the proper 
power source and that the power light is lit. 


1 Make sure that you wait for the power-on self test to complete before 
connecting. 


} Check that the Emulation Control Interface or debugger was configured 
with the correct LAN address. If the emulation probe is on a different 
subnet than the host computer, check that the gateway address is correct. 


1 Make sure that the emulation probe’s IP address is set up correctly. To do 
this, connect the emulation probe to a terminal or terminal emulator and 
enter the lan command. (See “To configure LAN parameters using a serial 
connection” on page 42.) 


(1 Make sure that the gateway address is set up correctly. The default 
gateway address of 0.0.0.0 does not allow the emulation probe to 
communicate with computers on other subnets. 


LI Ifyou have just changed the IP address of the emulation probe, leave the 
emulation probe powered on and connected to the LAN for a few minutes, 
then try again. Some hubs, routers, and hosts maintain tables of IP 
addresses and link-level addresses. It may take a while for these tables to 
be updated. 


1 Make sure that the proper LAN cable is connected. 


e Use a Category 5 cable if your connection is running at 100 Mbps 
(100BASE-TX). 

e For a point-to-point connection, use a crossover cable. 

e Fora LAN connection, use a regular LAN cable, not a crossover cable 
(the cable supplied with the emulation module, part number 5061- 
7342, is a crossover cable). 
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1 Watch the LAN LED’s to see whether the emulation probe is seeing LAN 
activity. The LED’s are described on page 156. Refer to your LAN 
documentation for information on testing connectivity. 


(4 It’s also possible for there to be a problem with the emulation probe 
firmware while the LAN interface is still up and running. In this case, you 
must reboot the emulation probe by turning the emulation probe power 
switch off then on again. 


If you have LAN connection problems 


LI Verify the IP address and gateway mask of the emulation probe. To do this, 
connect the emulation probe to a terminal or terminal emulator and enter 
the lan command (see See “To configure LAN parameters using a serial 
connection” on page 42.). 


If it takes a long time to connect to the network 


LJ Check the subnet masks on the other LAN devices connected to your 
network. All of the devices should be configured to use the same subnet 
mask. 


Subnet mask error messages do not indicate a major problem. You can 
continue using the emulation probe. 

If there are many subnet masks in use on the local subnet, the logic 
analysis system may take a very long time to connect to the network after it 
is turned on. 


If you have problems setting the LAN parameters using 
a logic analysis system 
If the E5900B emulation probe is not connected to an E5901B 


emulation module, then make sure the emulation probe is on the same 
subnet as the logic analysis system during initial setup; otherwise, 
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probe LAN address setup will fail. After initial setup, you can modify 
the emulation probe’s LAN parameters using the Emulation Control 
Interface before moving the probe to a different subnet. 


(J Another thing that will cause emulation probe LAN address setup to 
fail is a BOOTP daemon, running elsewhere on your network, that is 
configured to respond to the link-level address of the emulation probe. 
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Problems with the Serial Interface 


If you cannot verify RS-232 communication 


If the emulation probe prompt does not appear in the terminal emulator 
window: 


1 Make sure that you have connected the emulation probe to the proper 
power source and that the power switch is on. 


(1 Make sure that you have properly configured the data communications 
parameters on the host computer. 


1 Verify that you are using the correct cable. Use the cable and adapter 
which are supplied with the emulation probe. 


If you have RS-232 connection problems with the MS 
Windows HyperTerminal program 


4) Use the "HyperTerminal" program (usually found in the Accessories 
windows program group) and set up the "Communications..." settings as 
follows: 


Baud Rate: 9600 
Data Bits: 8 

Parity: None 

Stop Bits: 1 

Flow Control: None 


When you are connected, hit the Enter key. You should get a prompt back. 


1 Ifyou still don’t get a prompt, make sure the serial cable is connected to 
the correct port on your PC. 


1 Make sure you are using the serial cable which was supplied with the 
emulation probe. 


With certain RS-232 cards, connecting to an RS-232 port where the emulation 
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probe is turned off (or is not connected) will hang the PC. The only way to get 
control back is to reboot the PC. Therefore, we recommend that you always 
turn on the emulation probe before attempting to connect via RS-232. 


Agilent Technologies Emulation for the PowerPC 400/600/700 175 


SC wrerdndwsea a Fy WOW NY = 


_ 
So 


Chapter 12: Troubleshooting the Emulation Probe 
Problems with the Emulation Module 


Problems with the Emulation Module 


Occasionally you may suspect a hardware problem with the emulation module. 
The procedure in this section describes how to test the emulation module 
hardware, and if a problem is found, how to repair or replace the broken 
component. 


This procedure tests the hardware within the logic analysis system—the 
emulation module and its connection to the logic analysis system. To test the 
emulation probe, see page 177. 


To test the emulation module 


End any Emulation Control Interface or debugger sessions. 
Disconnect the emulation probe from the target system. 

In the system window, select the System Admin icon. 

Select the Admin tab. 

Select Self-Test... 

Read the Question dialog and select Yes if you wish to run the self tests. 
Select the Master Frame tab. 

Select the E5901B Emulation Module. 

Select Test All. 

When you are finished running self tests, select Quit. Then restart your 


session from the Session Manager window. 
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Problems with the Emulation Probe 


To run the emulation probe performance verification 
(PV) tests 


In addition to the power-up tests, there are several additional performance 
verification (PV) tests available. 


These tests can be performed through a 16700-series logic analysis system or 
via a serial or telnet connection. You will need an SMB Cf) to SMB Cf) cable 
such as Agilent part number 16532-61601. 


Before running probe performance verification: 

e Leave the emulation probe connected to the LAN and to the power supply 
or module/probe interconnect cable. 

e Leave the target board adapter installed inside the emulation probe. 

e End any Emulation Control Interface or debugger sessions. 


e Disconnect the target cable from the target system. (Power off the 
emulation probe while you do this.) 

e Connect an SMB cable from the "Break In" connector to the "Trigger Out" 
connector on the emulation probe. (If you aren't concerned about these 
signals, you may omit this step and ignore any related test failures.) 


To run the performance verification tests using the 
logic analysis system 


End any Emulation Control Interface or debugger sessions. 


Turn off the emulation probe and disconnect the emulation probe from 
your target system, then turn the emulation probe on again. 


Disconnect the emulation probe from your target system before running the 
tests. Running the Target Board Adapter Feedback Test with the target 
system connected can damage components on the target system. 
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In the system window, select the emulation probe icon then select 
Performance Verification. 


Select Start PV. 


The results will appear on screen. 


To run complete performance verification tests using a 
serial or telnet connection 


Connect an SMB cable between BREAK IN and TRIGGER OUT. 


2 Disconnect the probe/module interconnect cable. 


Turn off the emulation probe and disconnect the emulation probe from 
your target system, then turn the emulation probe on again. 


Disconnect the emulation probe from your target system before running the 
tests. Running the Target Board Adapter Feedback Test with the target 
system connected can damage components on the target system. 


Connect the emulation probe to your PC or workstation using a serial 
or LAN connection, as described in “Connecting the Emulation Probe 
to a Site LAN” on page 40. 


Use a telnet or a terminal emulator to connect to the emulation 
probe. 


Enter the pv 1 command. 


Options available for the py command are explained in the help screen 
displayed by typing help pv or? pv at the prompt. 


Examples 
Here are some examples of ways to use the pv command. 
To execute all of the tests one time: 


pv 1 
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To execute test 2 with maximum debug output repeatedly until a Ctrl-c is 
entered: 


iw =152 =v © 


The results on a good system, with the trigger out and break in SMBs 
connected, should similar to the following. 


U>pv 1 
Testing: HPE8130A Series Emulation System 
Test 1: Powerup PV Results Passed! 
Test 2: Emulation Module Port Feedback Test Passed! 
Test 3: Run Control FPGA Test Passed! 
Test 4: Run Control Clock Test Passed! 
Test 5: Break In and Trigger Out SMB Feedback Test Passed! 
Test 6: Target Board Adapter Feedback Test (FACTORY ONLY) Not Executed 
FAILED Number of tests: 1 Number of failures: 0 


Copyright (c) Agilent Technologies, Inc. 1999 
All Rights Reserved. Reproduction, adaptation, or translation without 
prior 
written permission is prohibited, except as allowed under copyright laws. 


HPE8130A Series Emulation System 
Version: A.01.00 Dec 30 1999 
Location: Generics 


HP E3454A PowerPC 700 JTAG Emulator 
Version: A.05.00 Oct 26 1999 
R> 


The product numbers and version information will be different for your 
emulation probe. The product numbers displayed are for the various 
pieces of firmware and will be different from the product number you 
used to order the product. 


If a performance verification test fails 


There are some things you can do if a failure is found on one of the tests. 
Details of the failure can be obtained through using a -v value (“verbose 
level”) of 9. 
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If there are random problems 


Occasionally development systems for the PowerPC using the Agilent 
emulation probe can experience erratic behavior, or random target connection 
and operation errors or failures. Two major causes for these problems are: 


e Crosstalk between the JTAG signals on the cable between the emulation 
probe and the target. 


e Noise from external fields being coupled into the target connection cable. 
Major external fields that can affect this connection include the startup 
and shutdown of nearby fluorescent lamps and CRTs. Universal motors in 
appliances such as vacuum cleaners and floor buffers can generate 
significant field impluses. 


The following are two potential solutions to the problems mentioned above. 


1. Reduce the TCK clock rate. A reduction from 32 MHz to 10 MHz 
(cf speed = 10 M) can cause up to a 50% reduction in the crosstalk. The 
most significant side effect is a reduction in download rate. If the increase 
in download times cannot be tolerated the TCK rate can be increased for 
the duration of the download time, then reduced to gain increased 
reliability while debugging. 


2. Prove an additional ground path between the emulation probe and the 
target system. The SMB connectors on the front of the emulation probe 
provide a solid ground connection. 


If the particular failure you see is not listed below, contact Agilent Technologies 
for assistance. 


Test 1: Powerup PV Results 
Failure of this test indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


Test 2: Emulation Module Port Feedback Test 


Failure of this test indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


This test exercises the hardware which drives the connection to the emulation 
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module. It does not test the module/probe interconnect cable. 
The test is not executed if the emulation probe is connected to an emulation 


module. 


Test 3: Run Control FPGA Test 
Test 4: Run Control Clock Test 


Failure of these tests indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


If the emulation probe fails one of these tests, it may have been damaged by 
electrostatic discharge through the target cable. To prevent such damage in 
the future, follow standard ESD preventive practices. 


Test 5: Break In and Trigger Out SMB Feedback Test 


Before returning to Agilent Technologies, check to ensure that you have 
connected a good cable between the two SMB connectors. 


Test 6: Target Board Adapter Feedback Test 


Failure of this test indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


This test exercises the I/O circuitry. If the test passes, but the emulation 
probe seems to have trouble communicating with the target system, the 
problem is probably with the target system. 


If this test was not executed, it means that the target board adapter you are 
using does not support the test. 
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Returning Parts for Service 


The repair strategy for this emulation solution is board replacement. 


Exchange assemblies are available when a repairable assembly is returned to 
Agilent Technologies. These assemblies have been set up on the “Exchange 
Assembly” program. This lets you exchange a faulty assembly with one that 
has been repaired, calibrated, and performance verified by the factory. The 
cost is significantly less than that of a new assembly. 


To return a part to Agilent Technologies 


Follow the procedures in this chapter to make sure that the problem is 
caused by a hardware failure, not by configuration or cabling problems. 


In the U.S., call 1-800-403-0801. Outside the U.S., call your nearest 
Agilent sales office. Ask them for the address of the nearest service 
center. 


To locate a sales or service office near you, go to http://www.tm.agilent.com 
and select Contact Us. 


Package the part and send it to the Agilent service center. 


Keep any parts which you know are working. For example, if only a cable is 
broken, keep the emulation probe. 


When the part has been replaced, it will be sent back to you. 


The unit returned to you will have the same serial number as the unit you sent 
to Agilent. 


In some parts of the world, on-site repair service is available. Ask an Agilent 
sales or service representative for details. 


182 Agilent Technologies Emulation for the PowerPC 400/600/700 


Chapter 12: Troubleshooting the Emulation Probe 
Returning Parts for Service 


To obtain replacement parts 


The following table lists some parts that may be replaced if they are damaged 
or lost. The part numbers are subject to change. Contact your nearest Agilent 
Technologies sales office for further information. 


Exchange assemblies 


Part number Description 
E3452-69501 Rebuilt assembly (PowerPC 4xx/6xx) 
E3454-69501 Rebuilt assembly (PowerPC 7xx) 


Replacement assemblies 


Part number Description 
0950-3043 Power supply for emulation probe (marked F1044B) 
E3494-61604 Ribbon cable - PowerPC 4xx, 60x, 7xx 
(Connects the emulation probe to the target system.) 
16700-61608 Expansion cable for emulation module 
(Connects the emulation module to the logic analysis system 
internally.) 
E8130-68702 Serial cable and adapter 


(Connects the emulation probe to a PC for configuration.) 


5061-7342 LAN cross-over cable 
(For point-to-point LAN connection from the emulation 
probe to the logic analysis system.) 


E8130-61601 14-pin module/probe interconnect cable 
(Connects the emulation module to the emulation probe.) 
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If you need to obtain help 


If, after following the troubleshooting steps and looking through the other 
sections in this chapter, the emulation probe still is not working: 


1 Write down the target processor version, the emulation probe firmware 
version, and the type of emulation probe (E5900A or E5900B). 


2 Call your nearest Agilent Technologies sales or service office. 


To locate a sales or service office near you, go to http://www.tm.agilent.com 
and select Contact Us. 


To clean the instrument 
If the instrument requires cleaning: 
1 Remove power from the instrument. 


2 Clean the instrument using a soft cloth that has been moistened in a 
mixture of mild detergent and water. 


3 Make sure that the instrument is completely dry before reconnecting it 
to a power source. 
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Chapter 13: Specifications and Characteristics 


The following operating characteristics are not specifications, but are typical 
operating characteristics for the Agilent Technologies E5900B emulation 
probe and E5901B emulation module. 


Operating characteristics 


The following operating characteristics are not specifications, but are typical 
operating characteristics. 
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Input/Output Electrical Characteristics 


Trigger Out SMB Port 


With a 50 Q load, a logic high is = 2.0 V, and a low is < 0.4 V. The output 
function is selectable (see “To configure the Trigger Out SMB port (All 
processors)” on page 98). 


Break In SMB Port 


Edge-triggered TTL level input, 20 pF, with 4.6 kQ to ground in parallel. 
Maximum input: +5 V to -5 V when the emulation probe is powered OFF; +10 
V to -5 V when the emulation probe is powered ON. Input function is 
selectable (see “To configure the Break In SMB port (All processors)” on 
page 97). 


Communication Ports 


Serial Port 


RJ12 connector (DB9-to-RJ12 adapter and serial cable included). 
RS-232 DCE to 9600 baud, 8-bit, no parity, one stop bit. 


IEEE 802.3 Type 10/100Base-TX LAN Port 


RJ-45 connector, is compatible with both 10 Mbps (10Base-T) and 100 Mbps 
(100Base-TX) twisted-pair ethernet LANs. 


Power Supply 


Input. 100-240 V, 1.0 A, 50/60 Hz, IEC 320 connector, 


Output. 12 V,3.3A 
CAT I (Mains isolated). 
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Compatibility See page 4 for a list of compatible processors. 


Input Characteristics 


; Symb 1/3 Vref 1/2 Vref 2/3 Vref 

Signal 
ol Min Max Min Max Min Max 
Vih 0.5 Vref 5.1V |0.65 Vref} 5.1V 0.8 Vref 5.1V 
Vil -0.1V | 0.2Vref |} -0.1V 0.35 V -0.1V | 0.5 Vref 
Ib 

TDO (Bias) +15uA 
Rin 4.7 kQ. pullup to Vref 
Cin TDO = 75 pF 


Input Characteristics 


Signal Symbol Min Max 

Vref Vin 1.65 V 5.5V 
Rin 25 kQ pulldown to ground 

SRESET, HRESET | Rin (inactive) 4.7 kQ pullup to Vref 
Rin (active) 12 Q pulldown to ground 
Cout 200 pF 
Vin 5.5V 


Output Characteristics Z, 


Signal Symbol Condition 


Voh/loh 66 Q + 15 Q to Vref 
TDI,TCK,TMS, TRST! 


Vol/lol 66 +1500 0.2V 


1 These signals must not be actively driven by the target system when the debug 
port is being used. 
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Output Model 
Model of output drive to TDI, TCK, TMS, and TRST. 
Probe-to-target Target System 
Emulation Probe or System Cable JTAG Connector 
Trace Port Analyzer Z, 
JTAG Pin 
60 
Vref Ground 
e6900e02.cdr 


V 
Note: Z, = 66 Q in the diagram above. 
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Environmental Characteristics 


Operating: Nonoperating: 
Temperature +5°C to +40°C -40°C to +70°C 
(+41°F to +104°F) (-40°F to +158 °F) 
: Operating or nonoperating: 
pitnade 4600 m (15 000 ft) 


Relative Humidity 15% to 95% @ 40°C for 24 hrs. 


Pollution Degree 2: Normally only dry non-conductive 
Pollution Degree pollution occurs. Occasionally a temporary conductivity 
caused by condensation may occur. 


For indoor use only. 


See the Declarations of Conformity at the end of this book for EMC, safety, 
and supplemental information. 


Emulation module environmental characteristics 


The Agilent E5901B emulation module meets the environmental 
characteristics of the logic analysis system in which it is installed. 


For indoor use only. 
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Analysis Probe A probing solution 
connected to the target 
microprocessor. It provides an 
interface between the signals of the 
target microprocessor and the inputs 
of the logic analyzer. Formerly called 
a “preprocessor.” 


Background Debug Monitor Also 
called Debug Mode, In Background, 
or In Monitor. The normal processor 
execution is suspended and the 
processor waits for commands from 
the debug port. The debug port 
commands include the ability to read 
and write memory, read and write 
registers, set breakpoints and start 
the processor running (exit the 
Background Debug Monitor). 


Debug Mode See Background 
Debug Monitor. 


Debug Port A hardware interface 
designed into a microprocessor that 
allows developers to control 
microprocessor execution, set 
breakpoints, and access 
microprocessor registers or target 
system memory using a tool like the 
emulation probe. 


Elastomeric Probe Adapter A 
connector that is fastened on top of a 
target microprocessor using a 
retainer and knurled nut. The 
conductive elastomer on the bottom 


of the probe adapter makes contact 
with pins of the target 
microprocessor and delivers their 
signals to connection points on top of 
the probe adapter. 


Emulation Migration Kit The 
hardware and software required to 
use an emulation probe with a new 
processor family. 


Emulation Module An emulation 
module is installed within the 
mainframe of a logic analysis system. 
An E5901A emulation module is used 
with a target interface module 
(TIM) or an analysis probe. An 
E5901B emulation module is used 
with an E5900B emulation probe 
and does not use a TIM. 


Emulation Probe An emulation 
probe is a standalone instrument 
connected via LAN to the mainframe 
of a logic analyzer or to a host 
computer. It provides run control 
within an emulation and analysis test 
setup. Formerly called a "processor 
probe" or "software probe." 


Emulator An emulation module or 
an emulation probe. 


Extender A part whose only 
function is to provide connections 
from one location to another. One or 
more extenders might be stacked to 
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raise a probe above a target 
microprocessor to avoid mechanical 
contact with other components 
installed close to the target 
microprocessor. Sometimes called a 
"connector board." 


Flexible Adapter Two connection 


devices coupled with a flexible cable. 


Used for connecting probing 
hardware on the target 


microprocessor to the analysis probe. 


Gateway Address An IP address 
entered in integer dot notation. The 
default gateway address is 0.0.0.0, 
which allows all connections on the 
local network or subnet. If 
connections are to be made across 
networks or subnets, this address 
must be set to the address of the 
gateway machine. 


General-Purpose Flexible 
Adapter A cable assembly that 
connects the signals from an 
elastomeric probe adapter to an 
analysis probe. Normally, a male-to- 
male header or transition board 
makes the connections from the 
general-purpose flexible adapter to 
the analysis probe. 


High-Density Adapter Cable A 
cable assembly that delivers signals 
from an analysis probe hardware 
interface to the logic analyzer pod 


cables. A high-density adapter cable 
has a single MICTOR connector that 
is installed into the analysis probe, 
and two cables that are connected to 
corresponding odd and even logic 
analyzer pod cables. 


High-Density Termination 
Adapter Cable Same as a High- 
Density Adapter Cable, except it has 
a termination in the MICTOR 
connector. 


In Background, In Monitor See 
Background Debug Monitor. 


Inverse Assembler Software that 
displays captured bus activity as 
assembly language mnemonics. In 
addition, inverse assemblers may 
show execution history or decode 
control busses. 


IP address Also called Internet 
Protocol address or Internet address. 
A 82-bit network address. It is usually 
represented as decimal numbers 
separated by periods; for example, 
192.35.12.6. 


Jumper Moveable direct electrical 
connection between two points. 


JTAG (OnCE) port See debug 
port. 


Label Labels are used to group and 
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identify logic analyzer channels. A 
label consists of a name and an 
associated bit or group of bits. 


Link-Level Address The unique 
address of the LAN interface. This 
value is set at the factory and cannot 
be changed. The link-level address of 
a particular piece of equipment is 
often printed on a label above the 
LAN connector. An example of a link- 
level address in hexadecimal: 
0800090012AB. Also known as an 
LLA, Ethernet address, hardware 
address, physical address, or MAC 
address. 


Mainframe Logic Analyzer A logic 
analyzer that resides on one or more 
board assemblies installed in a 16500, 
1660-series, or 16600/700-series 
mainframe. 


Male-to-male Header A board 
assembly that makes point-to-point 
connections between the female pins 
of a flexible adapter or transition 
board and the female pins of an 
analysis probe. 


MICTOR Connector A high-density 
matched impedance connector 
manufactured by AMP Corporation. 
High-density adapter cables can be 
used to connect the logic analyzer to 
MICTOR connectors on the target 
system. 


Monitor, In See Background 
Debug Monitor. 


Pod A collection of logic analyzer 
channels associated with a single 
cable and connector. 


Preprocessor See Analysis Probe. 


Preprocessor Interface See 
Analysis Probe. 


Probe Adapter See Elastomeric 
Probe Adapter. 


Processor Probe See Emulation 
Probe. 


Run Control Probe See 
Emulation Probe and Emulation 
Module. 


Setup Assistant Wizard software 
program which guides a user through 
the process of connecting and 
configuring a logic analyzer to make 
measurements on a specific 
microprocessor. The setup assistant 
icon is located in the main system 
window. 


Shunt Connector. See Jumper. 


Solution A set of tools for debugging 
your target system. A solution 
includes probing, inverse assembly, 
the B4620B Source Correlation Tool 
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Set, and an emulation module. 


Stand-Alone Logic Analyzer A 
standalone logic analyzer has a 
predefined set of hardware 
components which provide a specific 
set of capabilities. A standalone logic 
analyzer differs from a mainframe 
logic analyzer in that it does not offer 
card slots for installation of additional 
capabilities, and its specifications are 
not modified based upon selection 
from a set of optional hardware 
boards that may be installed within 
its frame. 


State Analysis A mode of logic 
analysis in which the logic analyzer is 
configured to capture data 
synchronously with a clock signal in 
the target system. 


Subnet Mask A subnet mask blocks 
out part of an IP address so the 
networking software can determine 
whether the destination host is on a 
local or remote network. It is usually 
represented as decimal numbers 
separated by periods; for example, 
255.255.255.0. 


Symbol Symbols represent patterns 
and ranges of values found on labeled 
sets of bits. Two kinds of symbols are 
available: 

1) Object file symbols — Symbols 
from your source code, and symbols 


generated by your compiler. Object 
file symbols may represent global 
variables, functions, labels, and 
source line numbers. 

2) User-defined symbols — Symbols 
you create. 


Target Board Adapter A daughter 
board inside the E5900B emulation 
probe which customizes the 
emulation probe for a particular 
microprocessor family. The target 
board adapter provides an interface 
to the ribbon cable which connects to 
the debug port on the target system. 


Target Control Port An 8-bit, TTL 
port on a logic analysis system that 
you can use to send signals to your 
target system. It does not function 
like a pattern generator or emulation 
module, but more like a remote 
control for the target’s switches. 


Target Interface Module A small 
circuit board which connects the 50- 
pin cable from an E5901A emulation 
module or E5900A emulation probe 
to signals from the debug port on a 
target system. Not used with the 
E5900B emulation probe. 


TIM See Target Interface Module. 
Timing Analysis A mode of logic 


analysis in which the logic analyzer is 
configured to capture data at a rate 
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determined by an internal sample 
rate clock, asynchronous to signals in 
the target system. 


Transition Board A board 
assembly that obtains signals 
connected to one side and rearranges 
them in a different order for delivery 
at the other side of the board. 


Trigger Specification A set of 
conditions that must be true before 
the instrument triggers. See the 
printed or online documentation of 
your logic analyzer for details. 


1/4-Flexible Adapter An adapter 
that obtains one-quarter of the 
signals from an elastomeric probe 
adapter (one side of a target 
microprocessor) and makes them 
available for probing. 
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Numerics 
32-bit mode, 100 


A 


address pattern test, 126 
address translation, 95 
address, IP, 41 
analysis probe 

definition, 191 
assistant 

See setup assistant 
automatic allocation, 46 


B 


background debug monitor, 191 
basic pattern test, 123 
BDM port 

See debug port 
BKG light, 155 
BNC 

break in, 97 

trigger out, 98 
BOOTP request, 45, 46 
Break In SMB, 97 
Break In SMB port, 187 
built-in commands, 163 

LAN configuration, 44 


C 


cable 
emulation probe, 67 
module/probe interconnect, 57 
point-to-point LAN, 39 
power, 26 
serial, 42 
cable board, 24 
See target board adapter 
cache disable, 102, 103 
caches 


enabling and disabling, 102, 103 


CD-ROM, installing software from, 


62 
cf command, 72 
cf proc, 74 
cf rrt, 78 
cleaning, 184 
clocks 
TCK speed, 76 
command line interface, 112 
logic analysis system, 113 
commands, built-in, 158 
communication ports, 187 
configuration 
emulation module, 69 
configuration files 
installing, 59 
configuring the emulation probe, 
72 
connection 
emulation module, 65 
host workstation, 37 
power, 26 
problems, LAN, 171 
problems, RS-232, 174 
sequence, 27 
connector 
1OBASE-T, 37 
debug port, 34 
JTAG, 30 
JTAG, designing, 34 
JTAG, levels, 164 
connector board, 191 
connector, serial, 187 
contacting Agilent Technologies, 
184 
crosstalk, 180 


D 


debug mode, 191 
QACK pull-down, 30 


debug port, 191 
connecting to, 67 
definition, 191 

debugger, 105 

default settings, 74 


delays, configuring, 91, 92, 93, 94 


design considerations, 29 
development port 

See debug port 
DHCP, 45 
dmwrop, configuring, 88 
driver firmware error, 165 
dynamic allocation, 46 


E 


E8130A product number, 179 
effective addresses, 95 
elastomeric probe adapter 
definition, 191 
electrical characteristics, 188 
EMC, 190 
emulation migration 
definition, 191 
See also migration 
emulation module 
connecting, 65, 67 
connecting to probe, 57 
definition, 191 
description of, 3 
firmware, 164 
installing, 53 
emulation probe 
definition, 191 
problems, solving, 177 
emulation solution, 28 
at a glance, 2 
definition, 193 
description of, 2 


environmental characteristics, 190 


equipment required 
emulation module, 22 
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equipment supplied 
emulation migration, 24 
emulation module, 22 
ethernet address, 44 
extender, 191 


F 


files 

loading vs. installing, 60 
firmware 

updating, 135 

version, 137, 138 
flexible adapter 

definition, 192 
flowchart, setup, 19 


G 


gateway address, 44, 171 
definition, 192 

general-purpose flexible adapter 
definition, 192 


H 


help, contacting Agilent, 184 

HIDO bits, 103 

high-density adapter cable 
definition, 192 

high-density termination adapter 
definition, 192 

host computer 
connecting to, 37 

HyperTerminal (MS Windows 

program), 174 


I 


IEEE 802.3, 37 
imwrop, configuring, 89 
information sources, 28 
init command, 165 
input/output electrical 
characteristics, 187 


installation, software, 59 

interconnect cable 
See cable, module/probe 

interconnect 

internet address, 41 

inverse assembler 
definition, 192 

IP address, 41, 44, 46, 171 
debugger connection, 108 
definition, 192 


J 


JTAG, 180 
acronym, 20 
designing connector, 34 
test clock, 76 
JTAG port 
connections, 34 
jumper, definition, 192 


L 


L2 cache disable, 102 
labels 
definition, 192 
LAN 
interface, 37 
lan command, 44 
LAN connection problems, 171 
LAN parameters, 46 
debugger, 108 
setting with DHCP, 45 
setting with emulation module, 
48 
setting with serial connection, 44 
verifying, 45 
ways to set, 38 
LAN port, 187 
LEDs, 155 
lights 
See status lights 


link-level address, 46 
definition, 193 
displaying, 44 
location of, 45 

loading configurations 
vs. installing, 59 


M 


mainframe logic analyzer 
definition, 193 
male-to-male header 
definition, 193 
manual allocation, 46 
mask, subnet, 172 
memory 
configuring delays, 91, 92, 93, 94 
configuring parity, 101 
configuring read, 87 
configuring write, 88, 89 
target, testing, 117 
testing, 169 
memory test, 117 
address pattern, 126 
basic pattern, 123 
list of tests, 121 
oscilloscope read, 132 
oscilloscope write, 133 
procedure, 122 
rotate pattern, 128 
walking ones, 130 
walking zeroes, 131 
MICTOR connector, definition, 193 
migration 
installing, 141 
minimum equipment, 20 
MMU, 95 
model, output, 189 
module/probe interconnect cable, 
57 
monitor, background debug, 191 
mrdop, configuring, 87 
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N 
noise, reducing, 30 


0) 


oscilloscope read test, 132 
oscilloscope write test, 133 
output model, 189 


P 


parity, configuring, 101 
PC 

connecting to, 37 
performance verification tests, 

177, 178 

performance, improving, 77 
physical addresses, 95 
ping command, 51, 171 
pods, logic analyzer, 193 
point-to-point LAN connection, 49 
port number 

changing, 44 

debugger, 108 

default, 41 
power off procedure, 27 
power on procedure, 26 
POWER signal, 99 
power supply, 26, 187 
preprocessor 

See analysis probe 
preprocessor interface 

See analysis probe 
processor family 

changing, 142 
processor revision, 163 
processor support package, 62 
processor type, 74, 136 
procs command, 74, 75 
product numbers, 179 
program counter, 163 
prompts 

list of, 158 

troubleshooting, 165 


pull down resistor, QACK, 30 
PV 
See performance verification 


Q 
QACK pin, 30 


R 


real-time runs, 78 
references, 28 
register commands, 163 
repair 
emulation module, 182 
requirements, 20 
RESET 
light, 155 
reset 
troubleshooting, 166 
reset behavior, 79, 81 
reset operation, 79, 81 
resistor, QACK, 30 
restrict to real-time runs, 78 
revision, processor, 163 
rotate pattern test, 128 
run control tool 
See emulation control interface 


S 


sequence, 27 
serial connection, 42 
cable, 42 
DCE or DTE selection, 174 
number of connections, 174 
problems, 174 
verifying, 43 
serial port, 187 
service ports, 44 
service, how to obtain, 182 
setup 
See configuration 


setup assistant, 140 
definition, 193 
networking disabled, 50 

setup flowchart, 19 

signals 
debug port, 34 

signals, expected levels, 164 

slow clock message, 149 

SMB, 180 
Break In configuration, 97 

software 
installing, 59 
list of installed, 63 

solution, 28 
at a glance, 2 
definition, 193 
description of, 2 

specifications 
characteristics, 185 

speed 
improving, 77, 103 

standalone configuration 
See point-to-point connection 
stand-alone logic analyzer 
definition, 194 

state analysis, 194 
definition, 194 

static allocation, 45, 46 

status lights, 155 

subnet mask, 44, 171, 172 
definition, 194 

switches 
LAN configuration, 44 

symbols 
definition, 194 


T 


target board adapter, 24, 142 
definition, 194 

target control port, 194 

target interface module (TIM) 
definition, 194 
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target system 
connecting to, 65 
memory tests, 117 
TCK 
clock rate, 180 
signal, 76 
TCP, 44 
telnet, 51, 52, 163, 171 
establish connection, 112 
temperature environmental 
characteristic, 190 
temperature specifications, 190 
terminal interface, 52 
LAN parameters, setting, 44 
test clock, 76 
testing 
target memory, 117 
procedure for, 122 
tests, emulation module, 176 
ThinLAN, 38 
timers 
freezing, 82 
timing analysis, 194 
definition, 194 
trace length, 30 
transition board 
definition, 195 
trigger 
definition of specification, 195 
limitations, 97 
trigger out configuration, 98 
Trigger Out SMB port, 187 
troubleshooting, 149 


U 


updating firmware, 136 
USER light, 155 


Vv 

versions, firmware 
emulation module, 138 
emulation probe, 137 


voltage reference, configuring, 99 
Vref signal, 99 


Ww 


walking ones test, 130 
walking zeros test, 131 
web interface, 114 
web sites 

Agilent logic analyzers, 28 
wizard 

See setup assistant 
workstation 

connecting to, 37 
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The information contained in 
this document is subject to 
change without notice. 


Agilent Technologies makes 
no warranty of any kind with 
regard to this material, 
including, but not limited to, 
the implied warranties of 
merchantability or fitness for 
a particular purpose. 


Agilent Technologies shall not 
be liable for errors contained 
herein or for damages in 
connection with the furnishing, 
performance, or use of this 
material. 


Safety 


This apparatus has been 
designed and tested in 
accordance with IEC 
Publication 1010, Safety 
Requirements for Measuring 
Apparatus, and has been 
supplied in a safe condition. 
This is a Safety Class I 
instrument (provided with 
terminal for protective 
earthing). Before applying 
power, verify that the correct 
safety precautions are taken 
(see the following warnings). In 
addition, note the external 
markings on the instrument that 
are described under "Safety 
Symbols." 


Warning 

¢ Before turning on the 
instrument, you must connect the 
protective earth terminal of the 
instrument to the protective 
conductor of the (mains) power 
cord. The mains plug shall only be 
inserted in a socket outlet 
provided with a protective earth 
contact. You must not negate the 
protective action by using an 
extension cord (power cable) 
without a protective conductor 
(grounding). Grounding one 
conductor of a two-conductor 
outlet is not sufficient protection. 


¢ Only fuses with the required 
rated current, voltage, and 
specified type (normal blow, time 
delay, etc.) should be used. Do 
not use repaired fuses or short- 
circuited fuseholders. To do so 
could cause a shock of fire hazard. 


¢ Service instructions are for 
trained service personnel. To 
avoid dangerous electric shock, 
do not perform any service unless 
qualified to do so. Do not attempt 
internal service or adjustment 
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rendering first aid and 
resuscitation, is present. 


e If you energize this instrument 
by an auto transformer (for 
voltage reduction), make sure the 
common terminal is connected to 
the earth terminal of the power 
source. 


¢ Whenever it is likely that the 
ground protection is impaired, 
you must make the instrument 
inoperative and secure it against 
any unintended operation. 


¢ Do not operate the instrument 
in the presence of flammable 
gasses or fumes. Operation of any 
electrical instrument in such an 
environment constitutes a definite 
safety hazard. 


¢ Do not install substitute parts or 
perform any unauthorized 
modification to the instrument. 


© Capacitors inside the 
instrument may retain a charge 
even if the instrument is 
disconnected from its source of 


supply. 


Safety Symbols 


AN 


Instruction manual symbol: the 
product is marked with this 
symbol when it is necessary for 
you to refer to the instruction 
manual in order to protect 
against damage to the product. 


J 


Hazardous voltage symbol. 
I 


Earth terminal symbol: Used to 
indicate a circuit common 
connected to grounded chassis. 


WARNING 


The Warning sign denotes a 
hazard. It calls attention to a 
procedure, practice, or the like, 
which, if not correctly 
performed or adhered to, could 
result in personal injury. Do not 
proceed beyond a Warning sign 
until the indicated conditions 
are fully understood and met. 


CAUTION 


The Caution sign denotes a 
hazard. It calls attention to an 
operating procedure, practice, 
or the like, which, if not 
correctly performed or adhered 
to, could result in damage to or 
destruction of part or all of the 
product. Do not proceed 
beyond a Caution symbol until 
the indicated conditions are 
fully understood or met. 


Agilent Technologies Inc. 
P.O. Box 2197 


1900 Garden of the Gods Road 
Colorado Springs, CO 80901-2197, U.S.A. 


Product Warranty 


This Agilent Technologies 
product has a warranty against 
defects in material and 
workmanship for a period of one 
year from date of shipment. 
During the warranty period, 
Agilent Technologies will, at its 
option, either repair or replace 
products that prove to be 
defective. 


For warranty service or repair, 
this product must be returned 
to aservice facility designated 
by Agilent Technologies. 


For products returned toAgilent 
Technologies for warranty 
service, the Buyer shall prepay 
shipping charges to Agilent 
Technologies and Agilent 
Technologies shall pay shipping 
charges to return the product to 
the Buyer. However, the Buyer 
shall pay all shipping charges, 
duties, and taxes for products 
returned to Agilent 
Technologies from another 
country. 


Agilent Technologies warrants 
that its software and firmware 
designated by Agilent 
Technologies for use with an 
instrument will execute its 
programming instructions when 
properly installed on that 
instrument. Agilent 
Technologies does not warrant 
that the operation of the 
instrument software, or 
firmware will be uninterrupted 
or error free. 


Limitation of Warranty 


The foregoing warranty shall not 
apply to defects resulting from 
improper or inadequate 
maintenance by the Buyer, 
Buyer- supplied software or 
interfacing, unauthorized 
modification or misuse, 
operation outside of the 
environmental specifications for 
the product, or improper site 
preparation or maintenance. 


No other warranty is 
expressed or implied. Agilent 
Technologies specifically 
disclaims the implied 
warranties of merchantability 
or fitness for a particular 


purpose. 


Exclusive Remedies 


The remedies provided herein 
are the buyer’s sole and 
exclusive remedies. Agilent 
Technologies shall not be liable 
for any direct, indirect, special, 
incidental, or consequential 
damages, whether based on 
contract, tort, or any other legal 
theory. 


Assistance 


Product maintenance 
agreements and other customer 
assistance agreements are 
available for Agilent 
Technologies products. For any 
assistance, contact your nearest 
Agilent Technologies Sales 
Office. 


Certification 


Agilent Technologies Inc. 
certifies that this product met 
its published specifications at 
the time of shipment from the 
factory. Agilent Technologies 
further certifies that its 
calibration measurements are 
traceable to the United States 
National Institute of Standards 
and Technology, to the extent 
allowed by the Institute’s 
calibration facility, and to the 
calibration facilities of other 
International Standards 
Organization members. 


About this edition 


This is the 

Agilent Technologies 
Emulation for the 
PowerPC 400/600/700 
User’s Guide. 


Publication number 
E3454-97006, February 2002 
Printed in USA. 


Information in this manual 
previously appeared in: 
E3454-97005, February 2001 
E3454-97004, August 2000 
E3454-97008, June 2000 
E3452-97004, May 2000 


Many product updates do not 
require manual changes, and 
manual corrections may be done 
without accompanying product 
changes. Therefore, do not 
expect a one-to-one 
correspondence between 
product updates and manual 
updates. 


UNIX is a registered trademark 
of The Open Group. 


Microsoft, Windows, MS 
Windows, and MS-DOS are US. 
registered trademarks of 
Microsoft Corporation. 


